Organization

Akira

0 mentions in 7 days · 2 in 30 days · 3 total · first seen Aug 13, 2026 · last 21d ago

Timeline3 articles

Employee benefits platform Paylogix says hackers stole financial and health

Akira ransomware gang stole financial, health, and passport data on tens of thousands of people from benefits administrator Paylogix in November.

Hackers stole files from Paylogix's network between November 13 and 18, exposing Social Security numbers, financial accounts, health insurance information, medical data, passport numbers, and taxpayer IDs. State breach notices report at least 67,789 affected people, including 64,383 in South Carolina. Paylogix did not name the attackers but appeared on the Akira ransomware gang's leak site in January. The company notified federal law enforcement, is cooperating with an investigation, and faces organizing class action lawsuits.

The RecordAug 25, 19:02 UTC · 21d agoData breach in the wild

Akira Ransomware Uses Safe Mode to Bypass EDR

An Akira affiliate rebooted a compromised host into Safe Mode to bypass EDR, but constrained memory crashed the encryptor before encryption completed.

Huntress reports an Akira affiliate gained access on August 4 via an MFA-less SonicWall VPN, enumerated Active Directory, archived file shares with WinRAR, and exfiltrated data to an attacker S3 bucket. The attacker rebooted the host into Safe Mode with Networking and preloaded AnyDesk into the Safe Mode service registry, disabling EDR and Defender's real-time protection for roughly ten minutes. The encryptor failed about 13 seconds after launch with out-of-virtual-memory errors caused by Safe Mode's stripped-down environment, and Defender later removed akira.exe after reboot. Huntress says this is the first observed Safe Mode abuse by Akira, following precedents by Snatch and AvosLocker, and provides detection guidance.

Security AffairsAug 17, 07:15 UTC · 29d agoRansomware in the wild

Akira Affiliate Crashes Ransomware After Attempting EDR Evasion

Huntress documented an Akira ransomware affiliate attack that failed after its anti-EDR tool crashed legitimate software and stopped encryption before completion.

Infosecurity Magazine reports on Huntress research into a failed Akira ransomware affiliate attack. The affiliate attempted EDR evasion using an anti-EDR tool, but the tool interfered with legitimate software on the client's system. The interference crashed the ransomware before encryption completed, sabotaging the attack; no completed encryption was reported.

Infosecurity MagazineAug 13, 09:30 UTC · Aug 13, 2026Ransomware

Appears with

threat actor Akira 3 malware Akira 2 organization Huntress 2 vendor Huntress 2 product AnyDesk 1 vendor Microsoft 1 vendor Paylogix 1 vendor SonicWall 1 victim Paylogix 1 malware Akira ransomware 1 organization FBI 1 organization Paylogix 1

Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.