Mooers Immigration Listed by akira Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On March 24, 2026, the Akira ransomware group listed Mooers Immigration on its data-leak site and stated that it had exfiltrated internal files during a ransomware attack. The number of individuals whose information may be involved is not publicly known. The group further claimed it would publish 138 gigabytes of corporate data, describing the material as including client documents such as passports, visas, driver’s licenses, Social Security numbers, and credit-card details, along with financial records.

What happened

The incident came to light when Akira posted Mooers Immigration on its leak site on March 24, 2026. The post asserted that internal files had been taken and that 138 gigabytes of data would be released. No independent confirmation of the volume, contents, or timing of any encryption or exfiltration has been made public. The organization has not issued a statement detailing its response or the scope of access gained by the attackers.

Inside akira

Akira is a ransomware operation that has been publicly tracked since 2023. The group typically gains initial access through remote-desktop services or unpatched vulnerabilities, then moves laterally inside networks before deploying encryption and copying files. It follows a double-extortion model, threatening to publish stolen data if a ransom is not paid. Akira maintains a leak site where it lists victims and, in some cases, releases samples or full archives. Its targets have included organizations in professional services, manufacturing, and other sectors that hold sensitive records.

Who is Mooers Immigration?

Mooers Immigration is a law firm that practices immigration and nationality law. Its services include employment-based and family-based immigration petitions, naturalization applications, and compliance planning for individuals and families. Firms of this type routinely collect and store detailed personal and financial information required for government filings, including identity documents, immigration histories, and supporting evidence.

What was likely exposed

The Akira listing states that the exfiltrated material contains client documents such as passports, visas, driver’s licenses, Social Security numbers, and credit-card information, as well as financial records. The exact categories and volume of data that were taken have not been independently verified. Organizations handling immigration matters commonly retain copies of passports, birth certificates, tax returns, employment records, and correspondence with government agencies; whether any or all of these categories are present in the claimed archive remains unconfirmed.

Why it matters

Immigration-law practices hold concentrated sets of identity and financial documents that can be used for identity theft, immigration fraud, or financial crimes if released. Individuals whose records appear in such files may face prolonged administrative burdens, including the need to replace government-issued documents or monitor accounts for misuse. For the firm, the incident adds operational costs related to investigation, client notification, and potential regulatory review, even when the precise contents of the data remain undisclosed.

Were you affected?

Individuals who have worked with Mooers Immigration can contact the firm directly for information about the incident and any steps it is taking. They may also place fraud alerts or credit freezes with the major credit bureaus and monitor statements from banks and government agencies. Running a free exposure scan of an email address against known breach data sets can show whether the address has appeared in previously published collections, though it will not confirm presence in this specific incident.

AICompiled with AI assistance from public sources and published under our editorial standards.