PYATOK Listed by Akira Ransomware Group

On September 12, 2025, architecture and urban design firm PYATOK appeared on the leak site of the Akira ransomware group. The attackers announced they would publish 30GB of stolen corporate data containing employees’ personal information, including USCIS forms with full details, medical records, credit card numbers, confidentiality agreements, payment details, finance and accounting files, client information, and project documents.

Reported Details of the Breach

Public reporting indicates the incident began as a ransomware attack in which Akira gained access to PYATOK’s internal systems, exfiltrated the data, and then encrypted the original files. The group posted a notice on its leak site stating it had obtained the 30GB archive and planned to release it unless the company met their demands. The exposed information includes sensitive employment forms that typically contain Social Security numbers, dates of birth, addresses, and immigration status, alongside medical information and payment records. No confirmed victim count has been released, but the nature of the files suggests current and former employees, their dependents, and clients are potentially affected.

Why This Matters for You and Your Family

When a company that handles your employment records, medical data, or client projects suffers a breach like this, the information lands in the hands of criminals who can use it for identity theft, fraudulent loans, tax fraud, or targeted phishing. USCIS forms and medical information are especially damaging because they combine multiple pieces of identifying data that are difficult to change. If you or a family member ever worked with or for PYATOK, or if your personal details appear in any of the client or project files, your risk of long-term fraud increases. Credit card numbers and payment details can lead to immediate unauthorized charges, while confidentiality agreements and internal financial files may expose additional personal or family information that was never meant to be public.

The Doxxing and Identity-Chain Risks

Stolen internal files often contain email addresses, usernames, phone numbers, and project notes that link online handles to real-world identities. Attackers can chain this data with information from previous breaches to build detailed profiles. A username found in a PYATOK project folder can be matched to gaming accounts, social media, or family email addresses, turning a single breach into a pathway for doxxing, harassment, or account takeovers. Credential leaks of this type frequently cascade into gaming platforms, where children’s accounts become targets because the same passwords or recovery emails are reused across work and home life.