Bervar and Jones Listed by akira Ransomware Group

On April 7, 2025, the Akira ransomware group added the Hawaii law firm Bervar and Jones to its public leak site and announced it would publish more than 102GB of internal documents containing client medical records, drivers licenses, passports, birth and death certificates, court confidential files, financial data, and NDAs.

Reported Details of the Breach

Public reporting on the Akira leak site describes the exfiltrated material as essential corporate documents from the firm, which has represented clients in Hawaii state courts, federal court, and arbitrations for decades. Ward D. Jones, a partner at the firm, has practiced law in the state for 30 years. The attackers claim the archive includes sensitive personal identifiers and legal records belonging to the firm’s clients. No exact number of affected individuals has been confirmed, but the volume and described contents indicate that thousands of current and former clients could have their private information exposed.

The incident follows the group’s standard pattern of stealing data before encrypting systems and then using the threat of publication to pressure victims. As of the publication date on the leak site, the full 102GB archive had not yet been released for public download, but samples and the group’s description were posted.

Why This Matters for You and Your Family

When a law firm’s client files are stolen, the people whose records were held there lose control over highly sensitive information. Medical records, passports, drivers licenses, and financial data can be used for identity theft, tax fraud, insurance fraud, or to impersonate you in court proceedings. If you or anyone in your family has ever been a client of Bervar and Jones, your private documents may now sit on a ransomware leak site where criminals and data brokers can access them.

Even if you were not directly named, family members listed on shared legal matters—spouses, children, or parents—can also be exposed. A single breach like this often becomes the starting point for long-term targeting because the documents contain enough detail to map relationships, addresses, dates of birth, and financial accounts.

The Doxxing and Identity-Chain Risks

Ransomware operators rarely stop at posting a single archive. Once client names, emails, phone numbers, or addresses appear, other criminals scrape the data and cross-reference it with previous breaches. This creates an identity chain: a gaming username linked to an email from this leak can lead to takeover of your child’s Fortnite or Roblox account, which in turn reveals chat logs, voice recordings, or linked phone numbers. The same information can be sold to doxxing services that publish home addresses and family details online.

Credential leaks like this one cascade into account takeovers across seemingly unrelated services. A court document containing an email and date of birth is enough for attackers to reset passwords on banking, email, or social media accounts that reuse even part of the same information.

Akira Ransomware Group’s Track Record

Public reporting attributes the attacks to the Akira ransomware group, which emerged in 2023. The group has targeted organizations across multiple sectors, including healthcare providers, legal practices, and manufacturing companies. Its typical playbook involves initial access through compromised credentials or remote desktop services, followed by exfiltration of sensitive files and deployment of ransomware to encrypt systems. Akira then demands payment to prevent publication of the stolen data and lists non-paying victims on its leak site with samples of the material. The group’s operations have affected dozens of organizations, according to trackers that monitor ransomware activity.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, usernames, and real identity so you can see exactly what this claimed breach connects to.
• Rotate any password you used at Bervar and Jones anywhere else it appears, then enable 2FA through an authenticator app rather than text messages.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next time your information surfaces you learn within hours instead of months.
• Cover the household with DoxxScan family protection that includes dependents and your children’s gaming accounts, which often become targets once a parent’s data appears in leaks.
• Let remediation specialists handle takedown requests for your exposed information on data broker sites and forums while you focus on securing accounts.

The exposure of more than 102GB of client records from a long-established Hawaii law firm shows how quickly private legal documents can reach criminals who specialize in identity theft and extortion. Taking concrete steps now limits how far attackers can travel down the chain that begins with this claimed breach. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1B+ breach records and 100+ platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that includes children’s gaming accounts—practical protection for you and your family when incidents like the Akira leak occur.