Shands Elbert Listed by akira Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

People who have worked with or been represented by the St. Louis law firm Shands, Elbert, Gianoulakis & Giljum, LLP may now face questions about the security of their personal and case-related information. On October 16, 2025, the firm appeared on a listing associated with the Akira ransomware group, which claimed to have taken internal files during a ransomware attack. The number of individuals affected remains unknown, and public detail on the full scope is limited, yet the nature of a law firm’s records means any exposure could touch sensitive personal and professional data.

This report sets out only what has been reported so far, places the claim in context, and outlines practical steps for anyone who may be concerned.

Breaking down the breach

According to the available record, Shands Elbert was listed by the Akira ransomware group on October 16, 2025. The listing describes an incident in which internal files were allegedly exfiltrated as part of a ransomware attack. No confirmed figure for the number of people affected has been released, and technical details such as the precise method of initial access, the duration of the intrusion, or whether systems were encrypted remain undisclosed in public reporting.

The group’s own statement on its leak site asserts that more than 31 GB of corporate documents would be uploaded and characterises the material as including clients’ and family members’ personal information. That statement is a claim by the threat actor; it has not been independently verified in the facts provided. At the time of the listing, the firm itself had not issued a public confirmation of the volume or exact contents of any stolen data.

The group behind it: akira

Akira is a ransomware operation that has been active since early 2023. Like many contemporary groups, it typically employs a double-extortion model: encrypting systems while also stealing data and threatening to publish it if a ransom is not paid. Public reporting on prior incidents shows the group has targeted organisations across multiple sectors, often using compromised credentials or unpatched remote-access services to gain entry, followed by lateral movement and data staging before encryption.

The group maintains a dedicated leak site where it posts victim names and, in some cases, sample files or larger archives. Listings are claims of compromise; they do not automatically constitute proof that every asserted detail is accurate. In this instance, Akira’s post about Shands Elbert follows that pattern, announcing an impending release of more than 31 GB of material and alleging disregard for client privacy. No further claims specific to this victim beyond the listing language have been established in the available facts.

Who is Shands Elbert?

Shands, Elbert, Gianoulakis & Giljum, LLP is a law firm based in St. Louis with more than fifty years of practice. It offers services in business law, education law, labor and employment, litigation, and estate planning. Its client base includes corporations, governmental entities, educational institutions, individuals, and small businesses. As a full-service firm handling these practice areas, it routinely holds confidential client communications, case files, personal identifiers, and financial or employment records.

A breach involving a law firm is consequential because the data it stores is often highly sensitive and subject to professional confidentiality obligations. Exposure can affect not only the firm’s own operations but also the privacy and legal interests of the clients and third parties whose information appears in its files.

What was likely exposed

The facts state that internal files were exfiltrated in a ransomware attack. The Akira listing further claims that the material includes names, dates of birth, phone numbers, addresses, driver’s-license numbers, and passport details belonging to clients and family members, and that more than 31 GB of corporate documents would be published. These assertions come from the threat actor and remain unverified by independent sources in the public record.

Exact contents of the stolen data have not been confirmed. Law firms of this type typically maintain client intake forms, correspondence, pleadings, contracts, estate-planning documents, employment records, and related personal identifiers. Whether any or all of those categories were among the files taken is unconfirmed. Readers should treat the group’s description as a claim rather than established fact.

Why it matters

For individuals whose information may have been involved, the practical risks include identity theft, targeted phishing, and misuse of personal identifiers such as dates of birth or government-issued document numbers. Even if the firm’s systems are restored, the possibility that copies of data remain in the hands of criminals creates a lasting exposure window. Corporate clients may face secondary risks if proprietary or litigation-related documents surface.

For the firm itself, the incident raises operational, reputational, and regulatory considerations common to any professional-services organisation that holds confidential records. Public detail on remediation steps or notifications to affected parties is limited at this stage.

What to do if you're exposed

Anyone who has been a client of the firm, or whose personal details may appear in its files, should consider placing a fraud alert or credit freeze with the major credit bureaus, monitoring financial and email accounts for unusual activity, and being cautious of unsolicited communications that reference legal matters or personal data. If the firm issues formal notifications, follow the guidance provided in those notices. Readers can also run a free exposure scan of their email address to check whether their information has already appeared in known breach data sets.

AICompiled with AI assistance from public sources and published under our editorial standards.