Akira ransomware group claims data theft at 11 North American organisations

The Akira ransomware group has listed 11 new organisations on its data leak portal, claiming to hold large quantities of sensitive information stolen from businesses across the United States and Canada. The latest victims span manufacturing, logistics, construction, finance and insurance, underlining the group's continuing focus on mid sized firms that support critical supply chains.

While details of the individual intrusions are still emerging, the listings indicate that personal employee data, financial information, contracts and internal documents are among the material the criminals say they have exfiltrated. In keeping with Akira's established tactics, the group is using the threat of public disclosure to pressure victims into paying a ransom for deletion of the stolen files and, where systems have been encrypted, for decryption keys.

New victims named on Akira's leak site

The 11 organisations now featured on Akira's portal collectively illustrate the breadth of the group's targeting strategy. The affected firms are:

• Wisconsin Knife Works (United States) – a specialist in tooling and precision manufacturing of woodworking cutting tools.
• The Smith Companies, Ltd. (United States) – a provider of advanced planning and wealth conservation solutions.
• EnviroTech Services, Inc. (United States) – a supplier of road and surface treatment products for both natural and man made environments.
• Next Generation Logistics, Inc. (United States) – a developer of transportation management software and logistics services.
• Security First Bank (United States) – a regional financial institution offering consumer and business banking services.
• Martin & Company (United States) – a technology enabled insurance solutions vendor serving carriers and managing general agents.
• Cleveland Construction (United States) – a family owned commercial contractor specialising in construction management.
• Goldenrod (United States) – a manufacturer of winding shafts and chucks used in the paper, film and foil industries.
• Abhe & Svoboda, Inc. (United States) – a restoration and industrial coatings contractor known for concrete repair and steel rehabilitation projects.
• MD Manouel Insurance Agency (United States) – a California based insurance agency offering personal and commercial products.
• Innomotive Solutions Group (Canada) – a North American provider of roll up doors, LED lighting and power lifting systems.

Akira claims to hold data volumes ranging from around 10 gigabytes to more than 80 gigabytes for some of these victims, including detailed personnel files, copies of identity documents, customer information, invoices and confidential contracts. None of these claims has been independently verified, and several of the organisations had yet to publicly comment at the time of writing.

A familiar double extortion playbook

Akira emerged in 2023 as a financially motivated ransomware group and has since built a reputation for combining network encryption with aggressive data theft. Its operators typically infiltrate corporate networks, quietly move laterally to identify valuable servers and backup systems, exfiltrate large troves of data, then deploy their ransomware to lock machines and disrupt operations.

The group runs a Tor based leak portal that mimics a retro computer terminal. Victims that refuse to pay are gradually exposed on this site, with each entry usually containing a description of the company and the type of data stolen, followed by links to compressed archives or torrents that third parties can download. The latest batch of 11 organisations appears under this familiar format.

Akira is known for tailoring ransom demands to the perceived financial position of each victim. Negotiation transcripts from previous incidents indicate that the group often seeks to position itself as a pragmatic business partner and may share small proof of life data samples or limited decryption keys to encourage payment. At the same time, its operators routinely threaten to sell or widely leak stolen data if companies attempt to restore systems and ignore the ransom demand.

Why these sectors are attractive targets

The latest list of victims captures a cross section of mid market firms that collectively underpin manufacturing and infrastructure across North America. Manufacturers such as Wisconsin Knife Works, Goldenrod and Innomotive Solutions Group support industrial production and logistics chains. Construction and restoration specialists such as Cleveland Construction and Abhe & Svoboda work on large commercial projects where operational delays can be costly.

Financial and insurance organisations including Security First Bank, The Smith Companies, MD Manouel Insurance Agency and Martin & Company manage highly sensitive personal and commercial data. The combination of regulatory pressure, reputational concerns and the cost of downtime can give attackers significant leverage in negotiations, especially where data exfiltration involves customer records and identity documents.

Mid sized companies in these sectors often operate with lean IT teams and may rely on a mix of legacy systems and modern cloud services. This mix can create security gaps that opportunistic threat actors are eager to exploit, particularly where remote access tools, VPN gateways or self hosted applications have not been patched promptly.

Potential impact on affected organisations

For each of the 11 listed organisations, the immediate concern is containment of the incident and restoration of normal operations. If ransomware encryption has taken place, IT teams will be working to identify impacted systems, restore from clean backups and verify that attackers no longer have access to the network.

The longer term consequences are likely to centre on data exposure. Listings on Akira's site refer to passport scans, driver licences, social security numbers, banking details and confidential commercial agreements. If accurate, that breadth of information would force victims to evaluate mandatory breach notification obligations, particularly in regions that impose strict reporting requirements for financial institutions and insurance providers.

Affected companies may have to contact staff, customers and partners whose data was stored in compromised systems. They may need to offer credit monitoring or identity protection services, and they could face regulatory scrutiny or civil litigation if investigators conclude that security controls were inadequate.

How Akira is believed to gain access

Security researchers who track Akira campaigns have observed a variety of intrusion methods. The group has previously taken advantage of vulnerabilities in VPN appliances and remote access services, exploited weaknesses in backup platforms and used stolen or brute forced credentials to log into exposed systems. Once inside a network, the attackers frequently run discovery tools, harvest additional passwords and attempt to disable security software before deploying encryptors.

In some instances Akira has been linked to affiliates using modern ransomware strains that are written in languages such as Rust or C plus plus and tuned for both Windows and Linux environments, including virtual infrastructure. The use of cross platform tools makes it easier for the group to disrupt complex corporate environments that rely heavily on virtual machines and cloud workloads.

Response options for organisations under attack

Incident responders typically advise victims of double extortion attacks to focus first on containment and recovery rather than ransom negotiations. That means isolating affected systems, revoking compromised credentials, rebuilding critical services from known good backups and conducting thorough forensic analysis to understand the scope of the intrusion.

Law enforcement agencies in multiple countries strongly discourage ransom payments, arguing that they fund further criminal activity and provide no guarantee that stolen data will be deleted. Even when a decryption key is supplied and systems are restored, copied data can still surface on criminal markets months or years later.

Organisations that find their names on a leak site but have not yet been contacted by attackers are encouraged to assume that some degree of compromise has occurred. Proactive steps can include rotating user and administrator passwords, reviewing remote access logs for unusual activity, checking configuration of backup systems and engaging external incident response specialists where in house resources are limited.

Lessons for the wider business community

The addition of 11 more organisations to Akira's list of victims highlights once again that ransomware remains one of the most disruptive cyber threats facing businesses. The incident serves as a reminder that even relatively modest companies can hold data that is valuable to criminals and that attackers are willing to spend weeks or months inside networks preparing their strike.

Cyber security specialists recommend a combination of measures to reduce the risk of similar incidents. These include multi factor authentication on all remote access points, rapid patching of exposed services, network segmentation to limit lateral movement and the regular testing of offline backups. Investment in security awareness training can also help staff recognise phishing attempts and suspicious login prompts that attackers often use to steal credentials.

For regulators and industry bodies, the Akira campaign underscores the importance of sector wide resilience, particularly in supply chains that span manufacturing, logistics, construction and financial services. Shared threat intelligence, coordinated incident response exercises and clear reporting frameworks can all help reduce the impact when well resourced criminal groups strike.

As investigations into the latest breaches continue, the affected organisations face a difficult period of recovery and potential legal exposure. Their experience is likely to become another case study in how determined ransomware operators exploit gaps in cyber hygiene and how costly those gaps can be when attackers gain the upper hand.