Agron (Five Ten) Adidas TERREX Listed by akira Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to target manufacturing and consumer brands as part of a broader pattern of double-extortion attacks that combine data theft with encryption threats. In this landscape, listings on criminal leak sites serve as public pressure tactics even when independent confirmation of the underlying intrusion remains limited. One such listing, dated June 24, 2024, named Agron (Five Ten) Adidas TERREX and attributed the incident to the akira ransomware group.

Public detail on the event is sparse. What is known comes primarily from the group’s own claim that internal files were exfiltrated and that roughly 20 GB of material would be released. The number of people affected has not been disclosed, and no independent verification of the breach’s full scope has been made public. The incident matters because the organisation sits inside a global sportswear supply chain and holds the kinds of operational records that, if exposed, can create lasting risk for employees, partners and customers.

What happened

On June 24, 2024, the akira ransomware group listed Agron (Five Ten) Adidas TERREX on its leak site. The group claimed it had carried out a ransomware attack that included the exfiltration of internal files. According to the listing, the attackers intended to share approximately 20 GB of data belonging to the company, which they described as closely associated with Adidas. The material was said to include finance, human-resources, marketing and other business information that would “be available soon.” No further technical details—such as the initial access vector, the encryption status of systems, or any ransom demand—have been publicly confirmed. The number of individuals whose personal information may have been involved remains unknown.

Who is akira?

Akira is a ransomware operation that emerged in early 2023 and has since become one of the more active groups practising double extortion. Typical tactics include gaining initial access through compromised credentials or vulnerable remote-access services, moving laterally inside a network, exfiltrating data, and then encrypting systems while threatening to publish the stolen material if payment is not made. The group maintains a Tor-based leak site where it posts victim names, sample files and, in some cases, full data archives. Akira has previously claimed responsibility for attacks against organisations in manufacturing, professional services and other mid-sized enterprises. Its listings are claims made by the actors themselves; they do not constitute independent confirmation that every asserted detail is accurate. In the present case, the only specific assertions about Agron (Five Ten) Adidas TERREX are those contained in the June 24 listing.

Agron (Five Ten) Adidas TERREX and its sector

Five Ten, also referred to as Agron in some contexts, is a manufacturer of specialised footwear for mountain biking, climbing and trail hiking. Founded in California in 1985 by Charles Cole, the brand grew into one of the leading climbing-shoe makers worldwide by 2011. Adidas acquired the company in November 2011 and has since integrated it into its outdoor and TERREX product lines. Organisations of this type typically maintain design files, supplier contracts, employee records, financial ledgers, marketing plans and customer-order data. Because the brand operates within Adidas’s larger corporate structure, a compromise can raise questions about the security of shared systems or third-party connections. A breach here is consequential not only for the immediate workforce but also for the broader outdoor-sports supply chain that relies on timely production and trusted brand reputation.

What data was at risk

The only data types named in the public claim are “internal files” said to have been exfiltrated in a ransomware attack. The group specifically referenced finance, human-resources, marketing and other business information, and stated that roughly 20 GB would be shared. Exact file inventories, whether personal data of employees or customers was included, and whether any of the material has actually been published remain unconfirmed. Companies in the specialised footwear and outdoor-equipment sector commonly hold employee payroll and contact details, supplier invoices, product-design documents, marketing campaign materials and limited customer-order histories. Until independent analysis of any released archive is available, the precise contents of the claimed 20 GB cannot be verified.

The real-world impact

For individuals whose information may have been among the internal files, the primary risks are identity-related fraud, targeted phishing that leverages employment or financial details, and potential exposure of sensitive personal data held in human-resources systems. Employees could face social-engineering attempts that reference real internal documents. For the organisation itself, the consequences include possible disruption of operations if systems were encrypted, reputational damage among retailers and athletes who rely on the brand, and the cost of forensic investigation and remediation. Because the scale of personal-data exposure is unknown, the full extent of downstream harm cannot yet be measured. Partners and suppliers whose contracts or correspondence appear in the claimed archive may also face secondary risk if those documents are misused.

Were you affected?

If you are a current or former employee, contractor or close business partner of Agron, Five Ten or related Adidas TERREX operations, treat the claim as a prompt for caution rather than confirmed personal exposure. Monitor financial accounts and credit reports for unusual activity, be alert to phishing messages that reference internal company details, and consider placing fraud alerts with credit bureaus if you believe your data may have been involved. Organisations rarely notify every potentially affected individual immediately, especially when the full scope remains under investigation. As a practical first step, you can run a free exposure scan of your email address to check whether it has already appeared in known breach data sets. That check will not confirm or rule out involvement in this specific incident, but it can surface other exposures that warrant attention.

AICompiled with AI assistance from public sources and published under our editorial standards.