Old NationalEvents Plaza Listed by akira Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to target a wide range of organisations, using data theft and public leak-site listings as leverage even when encryption outcomes remain unclear. Against that backdrop, Old NationalEvents Plaza appeared on a listing attributed to the akira ransomware group, reported on 9 January 2025. Public detail is limited: the number of people affected is unknown, and the precise method and full scope of any intrusion have not been independently confirmed. What is known is that the group claims internal files were exfiltrated, a development that matters because venues of this type routinely handle contracts, financial records and contact details belonging to staff and customers.

The listing itself is a claim by the threat actor rather than a verified disclosure by the organisation. Readers should treat the assertions carefully while recognising that any confirmed exposure of corporate and personal data can create lasting practical risks.

What happened

According to the available record, Old NationalEvents Plaza was listed by the akira ransomware group on 9 January 2025. The group asserts that internal files were exfiltrated in a ransomware attack. No independent confirmation of the intrusion timeline, entry vector, encryption status or total volume of data has been provided in the public facts. The number of individuals potentially affected remains unknown. The group’s own description of the material it claims to hold includes references to confidential licences, agreements and contracts, financial data such as audits, payment details and reports, and contact numbers and email addresses of employees and customers. It also states that the data was made available for download via torrent clients. These statements are claims originating from the listing and have not been corroborated by further public detail.

The group behind it: akira

Akira is a ransomware operation that has been active since early 2023 and is widely documented for employing double-extortion tactics. Typical activity involves gaining access to networks, exfiltrating data, encrypting systems where possible, and then threatening to publish stolen material on a dedicated leak site if a ransom is not paid. The group has previously listed organisations across manufacturing, education, professional services and other sectors. Listings on its site function as pressure tools; they do not by themselves prove the full accuracy or completeness of the claimed data sets. In this case, the appearance of Old NationalEvents Plaza is presented solely as the group’s claim. No additional statements attributed specifically to this victim beyond the listing content are available in the facts.

About Old NationalEvents Plaza

Old NationalEvents Plaza is described as a 280,000-square-foot events facility that provides flexible space and in-house services for planning and coordinating gatherings. Organisations of this kind operate in the hospitality and venue-management sector. They commonly maintain booking systems, client contracts, vendor agreements, employee records, payment processing information and customer contact details. A breach involving such an entity is consequential because the data held often mixes corporate financial and contractual material with personal identifiers of staff and event organisers or attendees. Disruption can affect day-to-day operations, client trust and regulatory obligations even when the exact scale of any compromise remains unconfirmed.

What was likely exposed

The facts state that internal files were exfiltrated in a ransomware attack. The group’s listing further claims the presence of confidential licences, agreements and contracts, financial data including audits, payment details and reports, and contact numbers and email addresses of employees and customers. Exact contents, file counts and whether any of these categories were fully or partially taken remain unconfirmed outside the actor’s assertions. Organisations in the events sector typically hold precisely these categories of information—contracts, invoices, staff directories and customer booking records—so the claimed types are consistent with normal business holdings. Readers should note that the precise data set has not been independently verified and that the number of affected individuals is unknown.

Why it matters

If the claimed material was indeed taken, employees and customers could face risks of phishing, social-engineering attempts or misuse of contact details. Financial records and payment information, if exposed, raise the possibility of fraud or further targeting of related accounts. For the organisation itself, the incident can lead to operational disruption, costs associated with investigation and remediation, and longer-term reputational effects with clients who rely on the venue for events. Because the number of people affected is unknown and the full contents unconfirmed, the concrete impact cannot yet be quantified; the potential for secondary harm remains real whenever personal and financial data leave controlled systems. Attribution rests on the group’s listing, so definitive conclusions about negligence or exact losses are not supported by the available facts.

If your data was in this claimed breach

Anyone who has done business with or worked for Old NationalEvents Plaza should treat the possibility of exposure seriously even while details stay limited. Monitor bank and credit-card statements for unfamiliar activity, enable multi-factor authentication on email and financial accounts, and consider placing a fraud alert or credit freeze if financial identifiers may have been involved. Change passwords on any accounts that reused credentials linked to the venue. Keep records of communications from the organisation about the incident. As a practical next step, readers can run a free exposure scan of their email address to check whether that address has already appeared in known breach data sets elsewhere; this does not confirm or rule out involvement in this specific incident but provides a useful baseline for further vigilance.

AICompiled with AI assistance from public sources and published under our editorial standards.