The Akeeli Group Data Breach

The Akeeli Group (akeeligroup[.]com), a US-based business services organization, was listed as a victim on the leak site of the N0n ransomware group on October 19, 2026. SOCRadar identified the listing through its monitoring of ransomware leak and extortion portals. The company operates internet-facing corporate mail infrastructure, and as a business services organization its work centers on corporate communications and client-facing services — a profile in which compromise of email systems can carry consequences well beyond a single endpoint. The listing reflects a leak-site post and has not been independently confirmed as a breach. The October 19 listing was not an isolated post: N0n published The Akeeli Group as part of a broad same-day US publishing event, signaling a high-volume wave of claims against American organizations on that date. Akeeli’s US base and business services classification place it squarely within that geographic focus, meaning the claim matches the group’s visible targeting pattern at the time rather than standing apart from it. SOCRadar’s observation confirms the leak-site listing itself; whether a compromise actually occurred at The Akeeli Group remains unverified and should be treated as alleged pending further evidence.

SOCRadar’s stealer-log query for akeeligroup[.]com returned 25 records. Fourteen of these are internal employee credentials on organization-owned systems, spanning the webmail control panel at akeeligroup[.]com:2096, the mail server at mail.akeeligroup[.]com, and SMTP relay infrastructure. Three records contain corporate-domain usernames exposed on external third-party services, and the remaining records capture additional employee credentials on internet-facing Akeeli endpoints. The dominant classification for this exposure is corporate intrusion risk. The freshness window runs from March 2026 through September 30, 2026 — nine months of continuous exposure — and at least two distinct @akeeligroup.com usernames recur persistently across both mail infrastructure and third-party services throughout that span. That pattern is consistent either with unrotated credentials or with recurring workstation compromise on the same accounts. The composition of this dataset matters because the affected systems form a connected, externally reachable mail stack. Webmail on port 2096, a dedicated SMTP relay, and a named mail server are all internet-facing, and all are associated with harvested employee credentials — a low-friction initial-access surface. For N0n, validated webmail credentials could open the door to inbox harvesting, phishing amplification into client contacts, and lateral movement into connected internal systems. The nine-month exposure window also means these records may have been sold and leveraged before the ransomware listing ever appeared. No telemetry result confirms that this specific access path was used in the alleged intrusion, but the overlap between exposed mail credentials and the victim’s internet-facing infrastructure does not rule out that connection. Immediate priorities follow directly from the exposure profile: rotate all @akeeligroup.com credentials, revoke active webmail sessions, audit the SMTP relay for unauthorized relay rules, and pull mail-server access logs from March 2026 forward. Given that the same usernames persisted across nine months of collected records, a multi-factor authentication review of the webmail and mail infrastructure is also warranted, together with continued stealer-log monitoring of the akeeligroup[.]com domain for new or recurring credential entries.