Akira

Active
Also tracked as Akia
1,530 victims named on the leak site
18 in the last 30 days
673 in the last 12 months
Jan 2023 first victim we recorded
Aug 14, 2026 most recent victim posted
9 leak sites tracked

Data as of August 16, 2026.

Credential exposure before the attack

26.8% of Akira victims whose domain we can identify (410 of 1,529) had employee credentials leak in the 12 months before Akira named them as a victim.

We don't know whether any of these credentials were how Akira gained initial access.

What industries Akira targets

Sector identified for 989 of 1,530 victims.

Manufacturing295
Financial Services112
Construction107
Legal82
Healthcare59
Logistics52
Technology52
Energy34

Where the victims are located

Country identified for 908 of 1,530 victims.

United States557
Canada54
Germany48
United Kingdom30
Italy29
Brazil21
Switzerland20
Australia17

Most recent Akira victims

VictimSectorCountryPosted
CF Supply cfsupplyinc.comConstructionUnited StatesAug 14, 2026
Alcast alcastcompany.comManufacturingUnited StatesAug 11, 2026
i4 Solutions i4.netNot identifiedUnited StatesAug 11, 2026
One Vision Imaging onevisionimaging.comNot identifiedUnited KingdomAug 11, 2026
Pharma Test Apparatebau pharma-test.deHealthcareGermanyAug 7, 2026
Tastemorr Snacks tastemorr.comManufacturingUnited StatesAug 7, 2026
Albers Mechanical Contractors albersmechanicalcontractors.comManufacturingUnited StatesAug 4, 2026
Belasco Electric belascoelectric.comConstructionUnited StatesAug 4, 2026
Northwood Country Club northwoodcountryclub.orgNot identifiedUnited StatesJul 30, 2026
Franz Krause artworksgroup artworksgroup.deNot identifiedGermanyJul 29, 2026
Emerge2 Digital emerge2.comNot identifiedCanadaJul 27, 2026
Kruse Construction kruseinc.comConstructionUnited StatesJul 23, 2026
University Sprinkler Systems universitysprinklers.comEducationCanadaJul 23, 2026
L&A Transport landatransport.comLogisticsUnited StatesJul 21, 2026
McKeever Varga & Senko mvs-cpa.comFinancial ServicesUnited StatesJul 21, 2026
Nesco Bus nescobus.comEducationUnited StatesJul 20, 2026
Westcoast Communication Services westcoastcomm.comTelecommunicationsUnited StatesJul 20, 2026
Plumley Engineering plumleyeng.comNot identifiedUnited StatesJul 17, 2026
Pioneer Construction pioneerinc.comHealthcareUnited StatesJul 16, 2026
Ironmark ironmarkusa.comLogisticsUnited StatesJul 14, 2026

Showing the 20 most recent of 1,530. Browse recent data breaches for more.

Akira leak sites

Addresses we've seen Akira publish victims from. Any .onion address needs the Tor Browser.

  • akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion
  • akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion
  • bxwu33iefqfc3rxigynn3ghvq4gdw3gxgxna5m4aa3o4vscdeeqhiqad.onion
  • cloak7jpvcb73rtx2ff7kaw2kholu7bdiivxpzbhlny4ybz75dpxckqd.onion
  • noescapemsqxvizdxyl7f7rmg5cdjwp33pg2wpmiaaibilb4btwzttad.onion
  • jbeg2dct2zhku6c2vwnpxtm2psnjo2xnqvvpoiiwr5hxnc6wrp3uhnad.onion
  • ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd.onion
  • xw7au5pnwtl6lozbsudkmyd32n6gnqdngitjdppybudan3x3pjgpmpid.onion
  • lockbit7ouvrsdgtojeoj5hvu6bljqtghitekwpdy3b6y62ixtsu5jqd.onion

Akira questions

Is Akira still active?

Yes. Akira posted its most recent victim on August 14, 2026. That's 18 victims in the last 30 days.

How many victims has Akira claimed?

Akira has named 1,530 victims on its leak site since we started tracking it. That counts organizations, not leaked files. A single victim often accounts for thousands of published files. 673 of them were posted in the last 12 months.

When did Akira first appear?

The first victim we recorded for Akira was posted on January 9, 2023. That's when the group entered our collection, which isn't necessarily when it started operating.

Which sectors does Akira target?

Manufacturing accounts for the most victims we can classify, with 295. Financial Services follows at 112. We could identify a sector for 989 of 1,530 victims, so treat this as the shape of the targeting rather than a full census.

Has Akira already got your credentials?

Check whether your employees' logins have leaked on the dark web before they're exploited.

Check your exposure →

Continuous dark web monitoring alerts you when your company's data shows up, whether that's employee credentials or files published after an attack.