Ascoma Group Listed by akira Ransomware Group

On March 12, 2025, the Akira ransomware group listed Ascoma Group on its leak site and threatened to publish more than 12 GB of stolen corporate documents. The files include contact numbers and email addresses of employees and customers, internal correspondence, passports, and other personal documents belonging to people whose information was held by the insurance and healthcare-cost-management company.

Reported Details of the Breach

Public reporting indicates that Ascoma operates two main divisions: ASCOMA International, which coordinates international operations, and ASCOMA Health/PACTILIS, focused on health insurance, healthcare cost management, and personal insurance. The Akira group claims to have exfiltrated internal files during a ransomware attack and has posted proof packets on its leak site hosted via ransomware.live.

The exposed data includes employee and customer contact details, passports and identity documents, and extensive internal emails. As of the listing date, the precise number of individuals affected remains unknown, but the volume and nature of the material suggest thousands of records are at risk. The group has given Ascoma a deadline to negotiate before full publication.

Why This Matters for You and Your Family

If you or any member of your family has ever been a customer of Ascoma, worked with the company, or had your insurance or healthcare paperwork processed through it, your personal information may now sit on a criminal leak site. Passports, email addresses, phone numbers, and internal correspondence are exactly the raw material criminals need to open accounts in your name, file fraudulent tax returns, or impersonate you to insurers and banks.

Even if you were not a direct customer, family members or dependents covered under group policies could be exposed. Once this volume of personal data reaches underground forums, it rarely disappears. Copies circulate for years, increasing the chance that someone will eventually target you or your children.

The Doxxing and Identity-Chain Risk

Stolen corporate documents rarely stay isolated. A single email address or phone number from this claimed breach can be linked to your social-media handles, gaming accounts, and family addresses. Attackers chain these pieces together to build a complete profile that enables everything from SIM-swapping to full identity theft. Credential leaks of this kind frequently cascade into account takeovers on gaming platforms, where children’s usernames and shared family passwords become entry points for further harassment or extortion.

Public reporting shows that ransomware groups like Akira often sell or publish such data in batches, giving other criminals easy access. The combination of identity documents and contact lists makes it simpler for attackers to map relationships across your household, turning one breach into a persistent threat that follows your family for years.

Akira Ransomware Group Track Record

Public reporting attributes the attack to the Akira ransomware group, which emerged in 2023. The group has targeted organizations across multiple sectors, with notable prior victims including municipalities, manufacturing firms, and healthcare-related companies. Their typical playbook involves initial access through compromised credentials or remote desktop vulnerabilities, followed by exfiltration of sensitive files before deploying ransomware. They then demand payment and, if unmet, publish samples and eventually the full dataset on their leak site to pressure victims.

What to Do

• Run a DoxxScan to map every link between your emails, phone numbers, handles, and real identity so you can see exactly what this claimed breach connects to.
• Rotate any password you used at Ascoma or any related insurance portal anywhere else it is reused, and switch on 2FA through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next time your information appears it is caught within hours instead of months.
• Cover the household with DoxxScan family protection that extends to dependents and children’s gaming accounts, which often chain back to the same addresses and emails stolen in incidents like this.
• Let remediation specialists handle takedown requests across data brokers and leak sites so you do not have to chase every copy yourself.

The Ascoma breach is a reminder that insurance and healthcare companies hold some of the most sensitive details about your daily life. Taking concrete steps now can limit how far criminals are able to travel down the identity chain that begins with this 12 GB dump. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1B+ breach records and 100+ platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that includes your children’s gaming accounts. Start your DoxxScan trial today and close the gaps before the next wave of abuse begins.