Northwood Country Club Data Breach

The Akira ransomware group claimed to have breached Northwood Country Club, a US-based hospitality organization, and listed the victim on its dark web portal on July 29, 2026. SOCRadar’s Dark Web Monitoring service detected this listing. Northwood Country Club aligns with the typical profile of Akira’s victims, which often include mid-sized U.S. organizations lacking dedicated security teams. The hospitality sector, while not the primary focus, is regularly targeted by Akira alongside their dominant focus on business services. In the 60 days preceding this listing, Akira claimed 46 other victims. The group primarily targets organizations within the business services, consumer services, and manufacturing sectors, and its victim base is predominantly located in the United States, Canada, and the United Kingdom. This victim, Northwood Country Club, fits the established pattern of Akira’s targeting in terms of geography and organizational size. Their categorization as a private member-services business, common in the hospitality industry, is a recurring pattern for Akira, indicating a consistent targeting strategy for entities that manage sensitive member and transactional data.

A query of stealer-log data for the domain northwood[.]cc returned no correlating records in the examined dataset. It is crucial to note that a null result from this specific query does not confirm the absence of a compromise. The dataset queried represents a paginated and filtered portion of the larger corpus, meaning that relevant records could exist outside this scope. Additionally, compromised

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.