Novasport s.r.o. Listed by akira Ransomware Group

On July 21, 2026, Czech sports-equipment manufacturer Novasport s.r.o. appeared on the leak site operated by the Akira ransomware group. The company, which produces the well-known LEKI brand of ski, hiking, and Nordic walking poles, was listed after a ransomware attack in which attackers claim to have exfiltrated 17 GB of internal corporate data. The listing states that the files include detailed employee information such as passports, along with projects, contracts, financial records, and client details. The notification does not specify how many individuals are affected.

Primary Disclosure Details

The Akira leak page explicitly names Novasport spol. s r.o. and describes the company’s founding in 1992 by Klaus Lenhart, owner of the LEKI brand. It states that data was taken during a ransomware incident and promises to publish the full 17 GB archive shortly. The disclosure lists the exposed material as employee passports and other personal information, project documentation, contracts, financial data, and client records. No exact count of impacted records or individuals is provided, and the precise date of initial compromise remains undisclosed by either the victim or the threat actor.

Why This Matters for You and Your Family

When a company that supplies sporting goods to athletes, retailers, and consumers suffers a breach, the personal details of its employees, suppliers, and customers can end up in criminal hands. If you or a family member have ever worked at Novasport, purchased LEKI products through an account, or appear in its vendor or client lists, your information may now be circulating among ransomware operators. Passports and financial documents are especially valuable because they enable identity theft, loan fraud, and targeted phishing that can reach your household. Even if you are not directly named, the exposure of client databases often creates secondary risks for anyone whose data was shared with the company in the ordinary course of business.

Doxxing and Identity-Chain Risks

Ransomware groups rarely stop at posting generic files. Once employee passports, home addresses, phone numbers, or email addresses appear on a leak site, they become building blocks for doxxing chains that link professional identities to personal accounts across the internet. A leaked work email can be tested against consumer services, gaming platforms, and social-media profiles. Children’s gaming accounts are frequently targeted in these cascades because parents often reuse credentials or store them in the same password managers. The result can be account takeovers, swatting attempts, or extortion demands directed at the entire household. Public reporting on similar incidents shows that data released on ransomware leak sites frequently resurfaces on underground forums within weeks, multiplying the exposure window.

Akira Group’s Known Track Record

Public reporting attributes the Akira ransomware group’s emergence to early 2023. Since then the gang has compromised organizations across North America, Europe, and Australia, focusing on mid-sized manufacturing, technology, and professional-services firms. Akira typically gains initial access through phishing, remote-desktop protocol brute-force attacks, or exploitation of unpatched VPN appliances. After exfiltrating data, the group deploys its encryptor and posts samples on its leak site, giving victims a short window to negotiate before full publication. Its playbook emphasizes volume over massive single payouts, with frequent leaks of employee personal documents and internal spreadsheets that can be weaponized for identity fraud. The group’s leak site remains one of the more active ransomware portals, updating multiple times per week.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, including any connection to Novasport or LEKI vendor records.
• Rotate any password you have ever used at Novasport or associated vendor portals, then enable 2FA through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure surfaces in hours instead of months.
• Cover the household with DoxxScan family protection that extends to dependents and children’s gaming accounts vulnerable to credential chaining from this claimed breach.
• Let remediation specialists perform hands-on takedown requests for any exposed personal documents appearing on data-broker or extortion sites.

The incident underscores that even manufacturers of specialized sports gear sit in the crosshairs of sophisticated ransomware operators who treat stolen personal data as both leverage and inventory. Acting quickly on credential hygiene and identity mapping limits how far attackers can travel down the chain that begins with a single corporate breach. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, and hands-on remediation by specialists, with household coverage that explicitly includes children’s gaming accounts at risk from cascading leaks like this one.