Akantha Listed by blacklock Ransomware Group

On December 23, 2024, the French legal software provider Akantha appeared on the leak site of the blacklock ransomware group. The company, which develops the Portalis platform used by law firms for case management, document sharing, and client data hosting, is claimed to have had internal files exfiltrated after a ransomware attack. Although the exact number of individuals affected remains unknown, any lawyer, law-firm staff member, or client whose information passed through Akantha’s systems could now have personal data circulating in criminal channels.

What's Publicly Reported from Reporting

Public reporting indicates that Akantha, a company with fewer than 25 employees and annual revenue under $5 million, was hit by a ransomware operation. The attackers extracted internal files and later published a download link on their leak site. The exposed data consists of internal documents rather than a structured database of customer records, but such material frequently contains names, addresses, phone numbers, email accounts, case notes, and billing information tied to both legal professionals and their clients. The primary source is the blacklock leak page hosted on an onion domain, with the incident first indexed by ransomware tracking services on December 23, 2024.

Why This Matters for You and Your Family

When a company that handles sensitive legal matters is breached, the fallout reaches far beyond the office. If you or anyone in your family has worked with a French law firm that uses Portalis, your contact details, case summaries, or financial records may now sit in an attacker’s archive. That information can be sold, swapped, or used to launch further attacks against you personally. Even if you are not a direct client, employees of small legal practices often reuse work passwords for personal email or banking, creating an easy bridge from a corporate breach to your household accounts.

The Doxxing and Identity-Chain Implications

Leaked internal files rarely stop at one person. A single spreadsheet can link a lawyer’s professional email to their personal mobile number, home address, spouse’s name, and even children’s school or activity details. Attackers follow these chains to map identities across social media, gaming platforms, and data-broker profiles. Once the connections are made, credential leaks like this one frequently cascade into account takeovers on email, cloud storage, or family gaming accounts. The result is doxxing that feels personal and targeted rather than random.

Blacklock Group’s Known Track Record

Public reporting attributes the attack to the blacklock ransomware group. The group emerged in 2024 and has focused primarily on small and mid-sized businesses across Europe and North America. Notable prior victims include other software vendors and professional services firms. Their typical playbook involves initial access through phishing or exploited remote desktop services, followed by exfiltration of internal documents, and then extortion demands backed by the threat of public leak. They publish samples and full datasets on their dark-web site when victims do not pay, a pattern consistent with the Akantha posting.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, then use the cleanup to remove what you can.
• Rotate any password you ever used at Akantha or Portalis wherever it appears, and switch on 2FA through an authenticator app instead of text messages.
• Enable continuous DoxxScan monitoring across 13.1 billion+ breach records and more than 100 platforms so the next exposure is caught in hours rather than months.
• Cover the household with DoxxScan family protection that extends to dependents and children’s gaming accounts, which often chain back to the same addresses and emails.
• Let remediation specialists handle takedown requests across data brokers and leak sites while you focus on securing your own devices and accounts.

The pace of ransomware leaks shows no sign of slowing, which means yesterday’s unknown exposure can become tomorrow’s identity theft or harassment campaign. Protecting yourself and your family requires more than changing one password. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1B+ breach records and 100+ platforms, AI-powered identity-chain mapping that connects scattered handles to real people, and hands-on remediation by specialists who manage takedowns for you. Its household coverage also safeguards children’s gaming accounts that frequently become entry points once credential leaks like the Akantha incident occur. Starting now limits the damage from breaches already in progress and reduces the chance that your family becomes the next easy target.