Voss Enterprises, Divvies Listed by akira Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to pressure organisations across real estate and retail by pairing encryption with data theft and public leak-site listings. In this climate, even smaller or mid-sized firms can find themselves named without immediate public confirmation of scale or impact. On 28 August 2023, the Akira ransomware group listed Voss Enterprises and Divvies, claiming it had exfiltrated internal files and would post them. The number of people affected remains unknown, and independent verification of the full scope has not been published. For customers, employees, and partners, the listing itself is reason enough to understand what is claimed and what practical steps follow.

Inside the incident

According to the reported listing dated 28 August 2023, Akira claimed responsibility for a ransomware attack that involved the exfiltration of internal files belonging to Voss Enterprises and Divvies. The group stated it would post the files of both companies that week and characterised the organisations as having shown “no hint of a desire to keep their company data safe.” No further technical detail—such as initial access method, dwell time, encryption status, or ransom demand—has been disclosed in the available record. The number of individuals affected is unknown. Public reporting at the time treated the leak-site entry as the primary source of the claim; confirmation from the organisations themselves is not part of the provided facts.

Because the facts identify only “internal files exfiltrated in [a] ransomware attack,” the precise volume, file types, or systems involved remain unconfirmed beyond the group’s assertion. Readers should treat the listing as an unverified claim unless and until additional evidence appears.

Who is akira?

Akira is a ransomware operation that became active in early 2023 and has since been documented targeting organisations in multiple sectors, including manufacturing, education, professional services, and consumer-facing businesses. Like many contemporary groups, it commonly employs a double-extortion model: encrypting systems while also stealing data and threatening to publish it on a dedicated leak site if payment is not made. Public reporting has associated Akira with ransomware binaries that can run on Windows and, in some campaigns, Linux environments, and with tactics that include credential abuse, exploitation of exposed remote-access services, and lateral movement once inside a network. The group maintains a Tor-based leak site where it names victims and, in some cases, releases sample or full data archives. These patterns are drawn from widely reported activity across numerous incidents; they do not constitute proof of the exact methods used against Voss Enterprises or Divvies. In this case, the only specific claim on record is the listing itself and the stated intention to post internal files.

Voss Enterprises, Divvies and its sector

Voss Enterprises operates in real estate; Divvies operates in retail. Real-estate firms typically manage property records, transaction documents, client contact details, financial arrangements, and internal operational files. Retail businesses commonly hold customer purchase histories, loyalty or account information, supplier and inventory data, employee records, and point-of-sale or e-commerce related materials. Both sectors routinely process personally identifiable information and commercially sensitive material as part of ordinary operations. A ransomware incident that includes data exfiltration therefore carries potential consequences for clients, tenants, shoppers, staff, and business partners even when the exact contents of the stolen files have not been independently catalogued. The dual listing of a real-estate entity and a retail entity on the same day underscores how opportunistic ransomware campaigns can span different industries without regard to size or public profile.

What data was at risk

The facts state that internal files were exfiltrated in a ransomware attack. No more granular inventory—such as customer databases, financial ledgers, employee records, or specific document categories—has been disclosed. Organisations of these types ordinarily hold names, addresses, contact details, contractual and transactional records, and internal correspondence. Whether any of those categories were among the files Akira claims to possess is unconfirmed. Because the people-affected count is unknown and the data types are described only at the level of “internal files,” it is not possible to state with certainty what personal or commercial information, if any, has been exposed. The group’s claim that it would post the files remains an assertion rather than a verified release catalogue.

What's at stake

For individuals whose information may have been among the internal files, the practical risks include unwanted contact, phishing or social-engineering attempts that reference real business relationships, and, in some cases, identity-related misuse if identifiers or financial details were present. For the organisations, a public leak-site listing can damage trust with clients and partners, create regulatory or contractual notification obligations depending on jurisdiction and data content, and impose recovery and investigative costs. Even when encryption is reversed or systems are restored, the separate problem of data already copied off the network persists. Because the scale and exact contents remain undisclosed, the concrete impact on any given person or counterparty cannot yet be measured; the prudent stance is to assume that internal material may have left the organisations’ control and to act accordingly.

What to do if you're exposed

If you have a past or current relationship with Voss Enterprises or Divvies—as a customer, tenant, employee, or supplier—monitor account statements and credit reports for unfamiliar activity, and treat unexpected emails or calls that reference those businesses with caution. Change passwords on related accounts, enable multi-factor authentication where available, and be alert for phishing that uses the incident as bait. Keep records of any suspicious contact. You can also run a free exposure scan of your email address to check whether your information has already surfaced in known breach data sets. If you believe sensitive personal data may be involved, consider placing a fraud alert with credit bureaus and following guidance from relevant consumer-protection or data-protection authorities in your region.

AICompiled with AI assistance from public sources and published under our editorial standards.