Mantis Creative. Formerly known as WCI Rally. Listed by akira Ransomware Group

On May 19, 2025, the Akira ransomware group listed Mantis Creative, a North American architectural visualization and creative agency formerly known as WCI Rally, on its leak site and announced it would publish more than 45 GB of internal corporate documents including contracts, client data, projects, and some financial records.

Reported Details of the Breach

Public reporting indicates the incident began as a ransomware attack in which attackers gained access to Mantis Creative’s systems, exfiltrated data, and later posted a listing on the Akira leak site. The exposed material consists primarily of business documents rather than a structured database of consumer records. No confirmed count of affected individuals has been released. The agency specializes in visualization and creative solutions for real estate projects and emerging brands, work that often involves sensitive client information, contracts, and project files containing personal or proprietary details.

Available reporting describes the data as including contracts, client data, projects, and some financial information. Because the files were allegedly exfiltrated before the public listing, any individual or business whose information appears in those documents may now face increased risk of identity theft, fraud, or further exposure.

Why This Matters for You and Your Family

When a company that handles client projects and contracts is breached, the ripple effects reach far beyond the corporate walls. If you or your family have worked with a real estate developer, architecture firm, or branding agency that used Mantis Creative, your names, addresses, contact details, or financial references could be inside the 45 GB now in attackers’ hands. Even seemingly routine project files can contain phone numbers, email addresses, dates of birth, or payment information that criminals can combine with data from other breaches.

Client data and contracts are especially dangerous because they often link personal identities to financial or property records. Once that information circulates on criminal forums, it can be sold, traded, or used to impersonate you. For families this means higher chances of fraudulent loans, tax fraud, or targeted phishing attacks that feel personal because attackers already know details about your home or business dealings.

The Doxxing and Identity-Chain Implications

Ransomware leaks like this one rarely stop at the initial files. Criminals frequently cross-reference newly exposed client lists, email addresses, and project contacts against other breach databases. A single leaked contract can reveal not only your name and address but also the names of family members, children’s schools, or associated online accounts. These connections create identity chains that allow attackers to map your digital life from one handle or email to another.

Credential leaks cascade into account takeovers and doxxing chains, especially when gaming accounts or family-shared logins are involved. A child’s Roblox or Fortnite account tied to a parent’s email from a breached client file can quickly become an entry point for further harassment or extortion. The speed at which this mapping happens leaves most people unaware until damage appears on credit reports or social media.

Akira Ransomware Group’s Track Record

Public reporting attributes the attack to the Akira ransomware group, which emerged in 2023. The group has targeted organizations across multiple sectors, often focusing on mid-sized businesses whose data can be leveraged for double-extortion: encrypting systems while threatening to publish stolen files. Akira’s typical playbook involves initial access through compromised credentials or remote desktop vulnerabilities, followed by exfiltration of sensitive documents and deployment of ransomware. They then demand payment to prevent publication on their leak site, using deadlines that pressure victims to respond quickly. Notable prior victims have included companies in manufacturing, healthcare, and professional services, according to trackers that monitor ransomware activity.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, handles, and real-world identity so you can see exactly what chains back to the Mantis Creative files.
• Rotate any password you used at Mantis Creative or any related vendor, then enable 2FA through an authenticator app instead of text messages.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next leak exposing you or your family is caught in hours rather than months.
• Cover the household with DoxxScan family coverage that includes dependents and children’s gaming accounts, which often become targets when parent credentials surface in leaks like this.
• Let DoxxScan remediation specialists handle takedown requests and data-broker removals while you focus on securing accounts and watching for fraud.

The Mantis Creative breach is a reminder that corporate ransomware incidents increasingly expose ordinary families through client relationships and shared projects. Taking concrete steps now can limit how far attackers can travel down the identity chains they are building. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, and hands-on remediation by specialists, with household coverage that explicitly protects children’s gaming accounts alongside adult identities.