[AKIRA] – Ransomware Victim: Moonlight Basin

AI Generated Summary of the Ransomware Leak Page

Moonlight Basin, a US-based operator in the hospitality and tourism sector, is presented as the victim in a ransomware leak post attributed to the group “akira.” The post bears the date November 3, 2025, and frames the incident as a data-leak event rather than a traditional encryption attack. The page describes Moonlight Basin’s profile as a Montana resort offering premier snow conditions, first-class lodging and vacation homes, fine dining, spa services, and easy access to attractions such as Yellowstone National Park, along with seasonal activities. It states that approximately 17 GB of corporate documents will be uploaded soon, including client and employee data, internal reports, contracts and agreements, accounting and financial documents, and NDAs. The post does not reveal an explicit ransom amount or an encryption claim.

As of the post date, there are no screenshots or images on the leak page. The content signals a forthcoming data release rather than an immediate encryption event, suggesting potential exposure of sensitive internal materials and personal data. The materials referenced could pose privacy and regulatory risks if released, given the mentions of client and employee data, internal reports, contracts, financial documents, and NDAs. There is no compromise date provided beyond the post date, and no URLs or external links are included in the available excerpt. The post’s stated intention to publish roughly 17 GB of files remains unverified in terms of exact contents and timing at this time.