Rafael Construction

Rafael Construction was compromised in a ransomware attack attributed to akira in December 2025. The organization, operating in the Construction sector in Unknown, was added to the group's data leak site as part of an extortion campaign.

akira operates as a financially motivated ransomware-as-a-service (RaaS) operation, exfiltrating sensitive data and threatening public disclosure to pressure victims into paying ransom demands.

Rafael Construction is a full-service commercial general contractor based in Las Vegas, Nevada, specializing in commercial development with services including ground-up construction, design-build, construction management, and public works projects.We will upload more than 20gb of corporate data soon. Personal employee files (passports, DL, social security numbers ~100), financials, confidential internal files, client information, NDAs, etc.