The Teaching Company, LLC Listed by akira Ransomware Group

On December 12, 2023, The Teaching Company, LLC — operating as The Great Courses — appeared on the leak site of the Akira ransomware group. The listing states that the company suffered a ransomware attack in which internal files were exfiltrated, with the threat actors promising to upload 60 GB of data that includes client information, accounting and finance records, course details, and even a holiday video. The notification does not specify the exact number of individuals affected.

Primary Disclosure Details

The Akira leak site entry states that The Teaching Company was hit by a ransomware operation and that attackers successfully removed internal files. It explicitly lists categories of information now held by the group: client records, extensive accounting and finance data, course-related materials, and miscellaneous content such as a holiday video. The posting notes that 60 GB will be published if demands are not met, though no ransom amount is disclosed. The exact volume and sensitivity of any personally identifiable information remain unquantified in the public listing.

Why This Matters for You and Your Family

If you have ever purchased courses from The Great Courses, your name, contact details, payment history, and possibly mailing address are likely among the client records now in criminal hands. Accounting and finance files can contain credit-card numbers, bank-routing details, or purchase patterns that reveal far more about your household finances than a simple breach of a streaming service would. Even if you bought only a few DVDs or downloads years ago, that data can be combined with other leaks to build a profile that puts you and your family at risk of identity theft, targeted phishing, or fraudulent loan applications. Children’s names sometimes appear in family accounts or gift orders, extending the exposure beyond the primary customer.

Doxxing and Identity-Chain Risks

Client information from educational purchases frequently includes email addresses and phone numbers that attackers cross-reference against credential-stuffing databases. A single reused password tied to a Great Courses account can hand over access to your email, online shopping profiles, or even children’s gaming accounts. Once those gaming handles are linked to a real name and home address, doxxing chains accelerate: harassers locate social-media profiles, family photos, and physical residences within hours. The inclusion of finance data raises the stakes further, enabling more convincing spear-phishing campaigns that reference specific past purchases to gain trust.

Akira Group’s Known Track Record

Public reporting attributes the emergence of Akira to early 2023. The group has since targeted organizations across healthcare, education, manufacturing, and professional services. Notable prior victims include municipalities, manufacturing firms, and other educational providers. Akira’s typical playbook involves initial access through compromised remote-desktop credentials or exploited vulnerabilities, followed by rapid exfiltration of sensitive folders before encryption. The group then posts samples on its leak site and pressures victims with deadlines, often mixing data-theft extortion with file-encryption demands. The Teaching Company listing follows this pattern exactly.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, handles, and real identity so you can see exactly what chains back to The Great Courses purchase.
• Rotate any password you used at The Great Courses anywhere else it appears, then enable 2FA through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure of your data is caught in hours, not months.
• Cover the household with DoxxScan family protection that extends to dependents and children’s gaming accounts often chained to the same address or parent email.
• Let remediation specialists handle data-broker takedown requests and opt-out processes that would otherwise consume weeks of your time.

The incident underscores how even a single educational purchase can feed long-term identity exposure when ransomware operators treat customer databases as leverage. Starting a DoxxScan trial gives you continuous monitoring across 13.1B+ breach records and 100+ platforms, AI-powered identity-chain mapping that links handles to real identities, hands-on remediation by specialists, and household coverage that includes children’s gaming accounts. These layered defenses turn a breach that has already occurred into a manageable remediation task rather than an open-ended threat.