Michael L Larson Listed by akira Ransomware Group

On February 13, 2026, the Akira ransomware group listed Michael Larson & Co., P.C., a Portland-area tax and advisory firm, on its leak site and announced plans to publish sensitive internal files containing financial data, passports, medical information, driver’s licenses, employee records, customer details, and personal files.

Reported Details of the Incident

Public reporting indicates the firm, which provides tax and client advisory services to businesses operating globally, nationally, and locally in the greater Portland area, was hit by a ransomware attack. The Akira group stated it had exfiltrated company data and would soon upload it to the leak site. The exposed material includes audit records, payment details, financial reports, invoices, employee information, and customer records containing passports, medical information, and driver’s licenses. The exact number of individuals affected remains unknown. The listing appeared on the group’s leak site, with the primary public record hosted via ransomware.live at the provided source link.

Why This Matters for You and Your Family

When a firm like Michael Larson & Co. suffers a breach, the people whose tax returns, financial records, or identification documents were stored there face direct risk. Passports, driver’s licenses, and medical information are high-value items for identity thieves. A single leak can give criminals enough to open accounts in your name, file fraudulent tax returns, or sell your details on underground markets. If you or any member of your family has used this firm for tax preparation, advisory work, or related services, your information may now be in the hands of attackers who have explicitly said they intend to publish it. Even if you are not a direct client, vendor or employee data can still expose family members whose records were included in the files.

The Doxxing and Identity-Chain Risks

Credential leaks and personal documents rarely stay isolated. A driver’s license number can be paired with an email address found in the same dataset, then used to reset passwords on other accounts. Public reporting shows these chains frequently lead to doxxing, account takeovers, and harassment. Gaming accounts belonging to you or your children are especially vulnerable because kids often reuse simplified passwords or email addresses tied to family identities. Once one service falls, attackers can map additional handles, phone numbers, and real-world details, expanding the exposure across social media, online shopping, and school-related platforms.

Akira Ransomware Group’s Known Track Record

Public reporting attributes the attack to the Akira ransomware group. The group emerged in 2023 and has since targeted organizations across multiple sectors with a consistent playbook: gain initial access, exfiltrate sensitive files, deploy ransomware to encrypt systems, and then extort victims by threatening to publish the stolen data on their leak site if payment is not made. Notable prior victims include companies in manufacturing, healthcare, and professional services. Akira typically posts samples or full datasets when victims refuse to pay, using the leak site to pressure both the targeted organization and the individuals whose records are exposed.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, usernames, and real identity so you can see exactly what chains back to this claimed breach.
• Rotate any password you used at Michael Larson & Co. or related services anywhere it has been reused, and switch on 2FA through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next time your information appears it is caught and addressed within hours instead of months.
• Cover the household with DoxxScan family protection that extends to dependents and children’s gaming accounts, which often become entry points for larger identity-chain attacks.
• Let remediation specialists handle the time-consuming work of sending takedown requests to data brokers and monitoring sites where your exposed documents surface.

The incident underscores that tax and advisory firms remain attractive targets because the records they hold can fuel years of fraud and doxxing. Acting quickly on the credentials and documents already exposed, while establishing ongoing visibility into new leaks, is the most practical way to limit damage for you and your family. DoxxScan by GalaxyWarden delivers that visibility through continuous monitoring across 13.1B+ breach records and 100+ platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that includes children’s gaming accounts. Source: https://www.ransomware.live/id/TWljaGFlbCBMIExhcnNvbkBha2lyYQ==