The Lewis Bear Listed by akira Ransomware Group: Ransomware Claim — What’s Alleged & What To Do
The Lewis Bear was listed by the Akira ransomware group on December 10, 2025, after internal files were exfiltrated in a ransomware attack. Anyone who may have had data held by the organisation should check for further updates and take appropriate steps to protect their information.
What happened
The Lewis Bear was added to the Akira group’s leak site on December 10, 2025. The listing asserts that corporate data had been removed during a ransomware operation. No further technical information, such as the date of the intrusion or the encryption status of systems, has been released by the company or by investigators.
Who is akira?
Akira is a ransomware operation that has been publicly active since early 2023. The group typically uses double-extortion tactics, encrypting systems and also removing data before demanding payment. Its leak sites regularly host claims against organizations in North America and Europe, though each listing remains an unverified assertion by the actors themselves.
About The Lewis Bear
The Lewis Bear Company was established in 1876 as a grocery business and is described as the oldest privately held corporation in Florida. After the grocery division was sold in 1995, the firm became a focused beer distributor. Organizations in beverage distribution routinely maintain records on employees, suppliers, customers, and financial transactions.
What data was at risk
The Akira listing claims that employee scanned documents, HR files, projects, agreements, detailed financials, and customer information were among the materials taken. The company has not confirmed these categories or released an inventory of affected records. The precise contents therefore remain unverified.
Why it matters
Even without confirmed numbers, exposure of employee identity documents and internal financial or customer records can create long-term risks of identity misuse or targeted fraud. For the organization, the incident adds to the operational and reputational costs already associated with ransomware events in the distribution sector.
If your data was in this claimed breach
Individuals who believe their information may have been involved should monitor accounts for unusual activity and consider placing fraud alerts with credit agencies. Running a free exposure scan of one’s email address against known breach repositories can help determine whether personal details have appeared in previously published data sets.
AICompiled with AI assistance from public sources and published under our editorial standards.
How this breach connects
More recent breaches
Pan-O-Gold Baking Company Listed by akira Ransomware GroupFuji Vegetable Oil Listed by akira Ransomware GroupKirby Agri Listed by akira Ransomware GroupChairmans Foods Listed by akira Ransomware GroupLatest breaches
Read GalaxyWarden’s full analysis of the The Lewis Bear Listed by akira Ransomware Group →
Publicly posted by akira — unverified claim, pending independent verification
Breach listings — particularly those originating from ransomware or leak sites — are third-party claims that may be unverified, incomplete, or inaccurate. A listing does not by itself confirm that a breach occurred or that any specific data was exposed. Severity is an automated assessment, not a definitive rating. Verification status is shown where available.
Attributions to threat groups and methods reflect public reporting and, in some cases, unverified claims made by the groups themselves; they may be incomplete or later revised. Recent Breaches and GalaxyWarden are independent and are not affiliated with, and do not endorse, any company or group named on this page. This information is aggregated from public sources for awareness only and is not legal, security, or investment advice.