Pennant Park Listed by akira Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On June 25, 2025, the independent middle-market credit firm Pennant Park appeared on a listing associated with the Akira ransomware group. The group claims it has taken more than 6 GB of internal files in a ransomware attack and is prepared to release them. For employees, clients and business partners whose records may sit inside those files, the practical stakes are immediate: personal identifiers, financial details and confidential business information could be exposed, sold or used for further fraud if the claim proves accurate.

Public detail remains limited. The number of people affected is unknown, and independent confirmation of the intrusion or the exact contents has not been published. What is known comes from the listing itself and the firm’s own description of its business. That is enough to outline the incident, the actor involved, and the concrete risks people should consider.

Breaking down the breach

According to the available record, Pennant Park was listed by the Akira ransomware group on June 25, 2025. The group states that internal files were exfiltrated during a ransomware attack and that it is ready to upload more than 6 GB of documents. No further technical details—such as the initial access method, the duration of access, or whether systems were encrypted—have been disclosed in the public summary. The number of individuals whose data may be involved is listed as unknown. The listing itself constitutes a claim by the group rather than independently verified confirmation of the full scope or success of the attack.

Who is akira?

Akira is a ransomware operation that became active in early 2023 and has since been linked to numerous attacks on companies across North America, Europe and other regions. Like many modern ransomware groups, it typically employs a double-extortion model: encrypting systems while also stealing data and threatening to publish or sell it if a ransom is not paid. Public reporting has associated Akira with the use of common initial-access techniques such as compromised credentials, exploitation of remote-access services, and living-off-the-land tools once inside a network. The group maintains a leak site where it posts victim names and, in some cases, sample files or full archives. Its claims about any specific victim, including the volume and nature of data allegedly taken from Pennant Park, should be treated as assertions by the threat actor until corroborated by the organisation or independent investigators.

About Pennant Park

Pennant Park describes itself as an independent middle-market credit provider that specialises in targeted exposure to core middle-market credit. Firms of this type typically originate, underwrite and manage loans and other credit facilities for mid-sized companies. In the course of that work they routinely hold sensitive financial records, client agreements, internal reports, and employee personnel files. Because the business sits at the intersection of private credit markets and corporate finance, a compromise can affect not only the firm’s own staff but also the portfolio companies and investors whose information is stored in its systems. The listing therefore carries consequences beyond a single corporate network.

The information in question

The public record names the exposed material simply as “internal files exfiltrated in a ransomware attack.” The Akira group’s listing elaborates on that claim, stating it is prepared to release more than 6 GB of documents that include employee documents (SSNs, IDs, passports, driver’s licences and similar), financial data, confidential reports and client data. These categories are presented as the group’s description of what it holds; they have not been independently verified in the available facts. Organisations in the middle-market credit sector commonly maintain precisely these kinds of records—employee identity documents for payroll and compliance, detailed financial statements, loan files and client correspondence. Until the firm or investigators confirm the actual contents, the precise data types and the number of individuals involved remain unconfirmed.

Why it matters

If the claimed files contain the categories listed by the group, individuals face several concrete risks. Employee identity documents can be used for tax fraud, new-account fraud or synthetic-identity schemes. Financial and client data can enable targeted phishing, business-email compromise or competitive intelligence gathering. Confidential reports may reveal strategic positions that affect ongoing deals or investor relations. For the organisation itself, the incident can disrupt operations, trigger regulatory notification duties, and erode trust among borrowers and capital partners. Because the number of people affected is unknown and the exact files remain unverified, the full scale of these risks cannot yet be quantified; the prudent assumption is that anyone whose information was stored in Pennant Park systems should treat the possibility of exposure seriously.

Were you affected?

If you are a current or former employee, client or business partner of Pennant Park, begin by monitoring financial accounts and credit reports for unexpected activity. Consider placing a fraud alert or credit freeze with the major credit bureaus, and be alert for phishing messages that reference the firm or its services. Change passwords on any accounts that may have shared credentials with work systems, and enable multi-factor authentication wherever possible. Official notifications, if required, will come from the organisation itself; until then, treat the Akira listing as an unverified claim. Readers can also run a free exposure scan of their email address to check whether that address has already appeared in known breach data sets, which can provide an early indication of wider exposure.

AICompiled with AI assistance from public sources and published under our editorial standards.