A ransomware gang called Akira says it broke into Sunrise Company’s computer network and stole company files. Sunrise has only officially confirmed that hackers accessed people’s names.
Sunrise Company, a real estate developer that manages resort communities in California’s Coachella Valley, has notified people that hackers accessed its computer network. Sunrise says it identified suspicious activity on its systems and later determined that an unauthorized person gained access to its network and copied certain files on April 23, 2026. The company filed a sample notice with the California Attorney General on July 28, 2026, about three months after the intrusion.
Sunrise Company says its security team detected suspicious activity on its network and immediately began an investigation. That investigation found that an unauthorized actor had gained access to the network and copied certain files on April 23, 2026. Sunrise says it finished reviewing which files and individuals were affected shortly before it filed its notice with the California Attorney General on July 28, 2026.
Akira is a ransomware group. Ransomware groups break into computer networks and steal files. They then demand payment, often threatening to publish the stolen data online if the company does not pay. Akira posted a claim about the Sunrise Company breach on its dark-web leak site on May 26, 2026, about a month after the intrusion. The group claimed to have stolen 13 gigabytes of data, including employee information, client information, and financial records.
Sunrise Company’s official notice to affected individuals confirms only that names were included in the accessed files. The template version of the notice reviewed for this post does not itemize other specific data types.
Akira’s claim goes further. The group says the stolen files include employee personal information, client information, and financial records, in addition to names. Sunrise Company has not confirmed this broader description, and there is no independent verification of Akira’s claim beyond the group’s own leak-site post.
Because of this gap between what Sunrise has officially confirmed and what Akira claims, individuals who receive a notice letter should read it closely. It will list the exact categories of information involved in their specific case.
Sunrise Company says the unauthorized access happened on April 23, 2026. Akira posted its extortion claim about a month later, on May 26, 2026. Sunrise did not file its notice with the California Attorney General until July 28, 2026 — roughly three months after the intrusion and about two months after Akira’s public claim. Sunrise has not explained the reason for this gap.
Sunrise Company says it is reviewing its security policies, procedures, and employee training to guard against future incidents. The company is offering affected individuals 24 months of complimentary credit monitoring and identity restoration services through Experian, plus up to $1 million in identity theft insurance. The enrollment deadline is October 31, 2026.
Companies that collect personal information — including through relationships with other businesses, as Sunrise describes in its notice — have a legal duty to protect that data. A three-month gap between the intrusion and formal notice, combined with a ransomware group’s claim of a much larger data haul than the company has confirmed, raises questions about whether Sunrise Company met that duty. Emery | Reddy is investigating potential claims on behalf of individuals affected by this breach.
Contact the Data Breach Attorneys at Emery | Reddy today for a Free Case Review.
Your Personally Identifiable Information (PII) includes information that can be used to identify you, such as your name and other personal details. Organizations that manage healthcare data are legally required to safeguard this information. When PII is exposed in a data breach, it can potentially be used by cybercriminals to commit identity theft, financial fraud, or other misuse.
Residents of California may be entitled to additional protections under the California Consumer Privacy Act (CCPA), which provides enhanced rights regarding the collection, use, and safeguarding of personal information.
How many people were affected by the Sunrise Company data breach?
Sunrise Company has not disclosed a total number. California does not require companies to publish a population count in this type of filing, and no other source has confirmed one yet.
What information did Sunrise Company confirm was exposed?
Sunrise Company’s notice confirms that names were included in the accessed files. Individual notice letters list any additional data types specific to each recipient.
What does Akira claim was stolen?
The ransomware group Akira claims it stole 13 gigabytes of data, including employee personal information, client information, and financial records. Sunrise Company has not confirmed this broader claim.
Is Sunrise Company offering identity monitoring?
Yes. Sunrise Company is offering 24 months of complimentary credit monitoring and identity restoration services through Experian, along with up to $1 million in identity theft insurance. The deadline to enroll is October 31, 2026.
Should I sign up for the monitoring if I get a letter?
Yes. It’s free, and Experian’s identity restoration specialists can help you if you ever need to dispute fraudulent activity connected to this breach.
What else can I do to protect myself?
Consider these steps:
Has anyone sued Sunrise Company over this breach?
Not as of this writing. No data-breach lawsuit against Sunrise Company has been identified yet.
Do I have a legal claim?
Companies that collect personal information have a legal duty to keep it secure. If that duty was not met, affected individuals may be entitled to compensation. Emery | Reddy offers free, no-obligation case reviews. Call 206.207.8929 or visit www.emeryreddy.com to speak with a data breach attorney.
Whether you’ve been injured on the job, subjected to mistreatment in the workplace, or affected by a privacy breach, our expert attorneys are here to help.
