Aschwanden & Partner Listed by akira Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Aschwanden & Partner AG, a Swiss engineering and planning firm, was listed on January 23, 2026, by the Akira ransomware group. The listing states that internal files were exfiltrated during a ransomware attack. The number of individuals affected remains unknown, and no independent confirmation of the data volume or contents has been made public.

The incident is significant because the organisation handles detailed project information tied to infrastructure and safety assessments. Any confirmed exposure would involve records that are not routinely held by other types of businesses.

Breaking down the breach

The only confirmed public information is the listing itself. Akira claims to have obtained 37 gigabytes of corporate data and states that the material will be uploaded. No date of the intrusion, method of access, or encryption status has been disclosed by the firm or by investigators. The scale of any operational disruption inside the company is also unreported.

Who is akira?

Akira is a ransomware group that first appeared in early 2023. It is known for a double-extortion approach that combines file encryption with the theft of data, followed by demands for payment to prevent publication. The group has targeted organisations across multiple countries and sectors, typically mid-sized entities with valuable internal records. Its listings on a dedicated leak site constitute claims by the actors rather than verified events.

Who is Aschwanden & Partner?

Aschwanden & Partner AG is a Swiss firm with more than 38 years of operation in civil engineering and planning. Its services include building construction, bridge construction, geotechnics, and earthquake-safety studies. Companies of this type routinely maintain project documentation, client correspondence, technical specifications, and internal administrative records that can span decades.

A breach at such an organisation can affect both the firm’s own employees and external parties whose projects or safety assessments are documented in the files.

The information in question

The Akira listing claims the exfiltrated material includes employee personal information, financial records, payment details, and extensive project documentation such as drawings and specifications. The precise categories and volume of data have not been independently verified. Organisations in this sector commonly hold technical files, contracts, and personnel records, but the exact contents of any exfiltration remain unconfirmed beyond the group’s statements.

Why it matters

Project files in engineering and geotechnical work often contain location-specific details, structural calculations, and safety-related information. If released, such material could be used to identify individuals or to reconstruct sensitive infrastructure plans. Employee and financial data, if exposed, could support targeted fraud or identity misuse. The absence of a confirmed count of affected people means the full scope of potential harm cannot yet be assessed.

What to do if you're exposed

Individuals who believe their information may be involved should monitor bank and credit accounts for unusual activity and place fraud alerts with credit bureaus where available. Changing passwords for any accounts linked to the organisation and enabling multi-factor authentication are immediate practical steps. Readers can run a free exposure scan of their email address against known breach data to check for prior appearances of their information in public records.

AICompiled with AI assistance from public sources and published under our editorial standards.