Akira
Data as of October 1, 2026.
Credential exposure before the attack
26% of Akira victims whose domain we can identify (413 of 1,588) had employee credentials leak in the 12 months before Akira named them as a victim.
We don't know whether any of these credentials were how Akira gained initial access.
What industries Akira targets
Sector identified for 1,035 of 1,589 victims.
| Manufacturing | 309 | |
| Construction | 117 | |
| Financial Services | 117 | |
| Legal | 84 | |
| Healthcare | 61 | |
| Technology | 53 | |
| Logistics | 52 | |
| Energy | 38 |
Where the victims are located
Country identified for 967 of 1,589 victims.
| United States | 598 | |
| Canada | 57 | |
| Germany | 51 | |
| United Kingdom | 32 | |
| Italy | 30 | |
| Brazil | 24 | |
| Switzerland | 21 | |
| Australia | 17 |
Most recent Akira victims
| Victim | Sector | Country | Posted |
|---|---|---|---|
| Geebee Garments geebeegarments.ae | Manufacturing | United Arab Emirates | Sep 29, 2026 |
| Knit Studios knitstudios.com | Not identified | United States | Sep 29, 2026 |
| Strack Construction strackco.com | Construction | United States | Sep 25, 2026 |
| Wallatec wallatec.com | Manufacturing | Austria | Sep 25, 2026 |
| Apex Litigation Support apex-lit.com | Not identified | United States | Sep 24, 2026 |
| HIT hit.si | Hospitality | Slovenia | Sep 24, 2026 |
| Urban Engineering urban-ltd.com | Construction | United States | Sep 24, 2026 |
| COE Press Equipment cpec.com | Manufacturing | United States | Sep 23, 2026 |
| Dis.el. diselsrl.com | Construction | Italy | Sep 23, 2026 |
| Twin Dragon Marketing tdmi-us.com | Not identified | United States | Sep 23, 2026 |
| Prestige Management prestigemgt.com | Real Estate | United States | Sep 22, 2026 |
| Anderson Industries anderson-industries.com | Construction | United States | Sep 21, 2026 |
| Javep Chevrolet javepchevrolet.com.br | Automotive | Brazil | Sep 18, 2026 |
| Practice Management maximizedrevenue.com | Financial Services | United States | Sep 18, 2026 |
| Vetta Digital vetta.digital | Manufacturing | Brazil | Sep 18, 2026 |
| Bee Maid Honey beemaid.com | Not identified | Canada | Sep 17, 2026 |
| Blossomland Accounting blossomlandllc.com | Financial Services | United States | Sep 17, 2026 |
| Manders Companies mandersco.com | Construction | United States | Sep 17, 2026 |
| Lazy Boyz lazyboyz.no | Not identified | Norway | Sep 16, 2026 |
| Pilot Precision Products pilotprecision.com | Manufacturing | United States | Sep 16, 2026 |
Showing the 20 most recent of 1,589. Browse recent data breaches for more.
Akira leak sites
Addresses we've seen Akira publish victims from. Any .onion address needs the Tor Browser.
akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onionakiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onionbxwu33iefqfc3rxigynn3ghvq4gdw3gxgxna5m4aa3o4vscdeeqhiqad.onioncloak7jpvcb73rtx2ff7kaw2kholu7bdiivxpzbhlny4ybz75dpxckqd.onionnoescapemsqxvizdxyl7f7rmg5cdjwp33pg2wpmiaaibilb4btwzttad.onionlockbit7ouvrsdgtojeoj5hvu6bljqtghitekwpdy3b6y62ixtsu5jqd.onionijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd.onionjbeg2dct2zhku6c2vwnpxtm2psnjo2xnqvvpoiiwr5hxnc6wrp3uhnad.onionxw7au5pnwtl6lozbsudkmyd32n6gnqdngitjdppybudan3x3pjgpmpid.onion
Akira questions
Is Akira still active?
Yes. Akira posted its most recent victim on September 29, 2026. That's 39 victims in the last 30 days.
How many victims has Akira claimed?
Akira has named 1,589 victims on its leak site since we started tracking it. That counts organizations, not leaked files. A single victim often accounts for thousands of published files. 658 of them were posted in the last 12 months.
When did Akira first appear?
The first victim we recorded for Akira was posted on January 9, 2023. That's when the group entered our collection, which isn't necessarily when it started operating.
Which sectors does Akira target?
Manufacturing accounts for the most victims we can classify, with 309. Construction follows at 117. We could identify a sector for 1,035 of 1,589 victims, so treat this as the shape of the targeting rather than a full census.
Has Akira already got your credentials?
Check whether your employees' logins have leaked on the dark web before they're exploited.
Check your exposure →Continuous dark web monitoring alerts you when your company's data shows up, whether that's employee credentials or files published after an attack.