P.N. Sakkoulas Listed by akira Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to target professional publishers and specialised firms whose work depends on confidential client material and internal records. In this climate of opportunistic extortion, listings on criminal leak sites have become a common way for attackers to apply pressure. On 17 February 2025, the ransomware group known as akira publicly listed P.N. Sakkoulas, a Greek legal publisher, claiming to have stolen internal files. The number of people affected remains unknown, and independent confirmation of the intrusion is limited to the group’s own statements.

The listing matters because organisations that handle legal publishing routinely process sensitive professional and personal data. Even when exact contents stay unconfirmed, the mere claim of exfiltration raises practical risks for employees, customers and business partners whose contact details or contractual information may have been among the material taken.

Inside the incident

Public reporting states that P.N. Sakkoulas was listed by the akira ransomware group on 17 February 2025. The group asserts that it conducted a ransomware attack in which internal files were exfiltrated. No further technical details—such as the initial access vector, the precise date of intrusion, the volume of data removed, or whether encryption was also deployed—have been disclosed in the available record. The number of individuals affected is listed as unknown.

Akira’s leak-site entry claims the group is “ready to upload a lot of essential corporate documents such as: contact numbers and e-mail addresses of employees and customers, financial data (audits, payment details, reports), confidential licenses, agreements and contracts, etc.” These statements remain unverified claims by the attackers; no independent forensic confirmation of the specific files or their authenticity has been published. Beyond the listing itself and the organisation’s known publishing activities, public detail on the incident is limited.

Inside akira

Akira is a well-documented ransomware operation that emerged in 2023 and has since conducted numerous double-extortion campaigns. The group typically gains access through compromised credentials, phishing, or unpatched remote-access services, then steals data before encrypting systems and threatening public release. Its operators maintain a dark-web leak site where they post victim names and sample files to increase pressure for payment. Prior activity has included targets across manufacturing, professional services, education and other sectors in Europe, North America and elsewhere. The group’s public statements about any single victim, including the claim that it holds P.N. Sakkoulas material ready for release, should be treated as assertions rather than established fact unless corroborated by the organisation or independent investigators.

About P.N. Sakkoulas

P.N. Sakkoulas is a specialised legal publisher that produces law books and the journals “Criminal Chronicles” and “Chronicles of Private Law.” Firms of this type serve lawyers, academics, courts and students, and therefore maintain databases of authors, subscribers, institutional customers and internal commercial records. A breach involving such an organisation is consequential because the material it holds often includes professional contact details, contractual arrangements and financial information that, if exposed, can facilitate further social-engineering or fraud attempts against the legal community.

What data was at risk

The only data types named in connection with the incident are “internal files exfiltrated in ransomware attack.” Akira’s listing further claims possession of contact numbers and e-mail addresses of employees and customers, financial data including audits, payment details and reports, plus confidential licences, agreements and contracts. These remain the group’s unverified assertions. Exact contents and volumes are unconfirmed. Organisations in legal publishing typically hold subscriber lists, author correspondence, royalty and payment records, licensing agreements and internal financial reports; whether any of those categories were among the files taken in this case has not been independently established.

What's at stake

For individuals whose details may have been included, the concrete risks include targeted phishing, identity-related fraud and unwanted contact using legitimate-looking professional information. Employees and customers could face attempts to exploit trust relationships within the legal sector. For the organisation itself, the stakes include potential disruption of publishing operations, reputational harm among professional readers, possible regulatory scrutiny under data-protection rules, and the cost of forensic investigation and remediation. Because the scale of any exposure remains unknown, the practical impact cannot yet be quantified, but the combination of claimed contact data and financial records creates a clear avenue for follow-on harm if the material is genuine and is released or sold.

Were you affected?

If you have had dealings with P.N. Sakkoulas as an employee, author, subscriber or customer, treat any unexpected messages that reference the firm with caution. Monitor financial accounts for unusual activity, enable multi-factor authentication on email and professional accounts, and consider changing passwords that may have been reused. Readers can also run a free exposure scan of their email address to check whether their information has already appeared in known breach data sets. Official notifications, if any are issued by the organisation, should be followed carefully; until then, public detail remains limited to the ransomware group’s claims and the basic facts of the listing.

AICompiled with AI assistance from public sources and published under our editorial standards.