Av Alumitran Listed by akira Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

People whose names, financial details or project records sit inside Av Alumitran’s systems now face the practical question of whether those records have left the company’s control. On 14 May 2025 the ransomware group that calls itself akira publicly listed the firm and claimed it had taken more than 80 GB of internal files. The number of individuals affected remains unknown, and independent confirmation of the theft has not been published, yet the volume and categories of data the group says it holds make the listing consequential for anyone who has done business with, or worked for, the aluminium-extrusion company.

What follows is a factual account of the claims that have been made, the limited public detail available, and the steps ordinary people can take while the picture remains incomplete.

What happened

On 14 May 2025, Av Alumitran appeared on the leak site operated by the akira ransomware group. The listing asserts that the group conducted a ransomware attack, exfiltrated internal files, and intends to publish more than 80 GB of corporate data. The material is described as including project data (descriptions, drawings and related documents), commercial agreements, and highly detailed financial records such as audits, payment details, reports and invoices. No independent verification of the intrusion, the exact date of the attack, or the full contents of the claimed archive has been released. The number of people whose personal or financial information may be inside those files is listed as unknown. Public detail on the technical method used to gain access is likewise undisclosed.

Who is akira?

Akira is a ransomware operation that became publicly active in 2023. Like many contemporary groups, it typically employs a double-extortion model: encrypting systems while also stealing data and threatening to publish it if a ransom is not paid. The group has previously listed victims across manufacturing, professional services and other sectors, often advertising large data volumes on its leak site. Its public statements are claims made by the attackers themselves; they are not independently audited. In this case the only assertion specific to Av Alumitran is the leak-site listing and the accompanying description of the 80 GB archive. No further statements by the group about this particular victim have been reported in the available facts.

About Av Alumitran

Av Alumitran is an established company with more than 40 years of experience in aluminium extrusion. Firms in this sector design and produce aluminium profiles used in construction, industrial equipment and consumer products. They routinely hold engineering drawings, project specifications, supplier and customer contracts, and detailed financial records. Because the work involves long-running commercial relationships and technical intellectual property, a breach of internal files can affect not only the company’s own staff but also clients, partners and suppliers whose data appears in project folders or payment systems. The precise scope of any personal data held by Av Alumitran has not been disclosed in connection with this incident.

What was likely exposed

The only data types named in the public claim are “internal files” said to have been exfiltrated in a ransomware attack. The group further describes the archive as containing project data (descriptions, drawings and similar material), agreements, and very detailed financial data including audits, payment details, reports and invoices. No inventory of personal identifiers—such as employee records, customer contact lists or national identification numbers—has been published. Organisations of this kind typically retain such information as part of ordinary operations, yet the exact contents of the claimed 80 GB set remain unconfirmed. Readers should treat any assertion about specific personal data as provisional until independent verification appears.

What's at stake

For individuals, the concrete risks centre on the financial and contractual material the attackers say they hold. Payment details and invoices can be used for fraud or social-engineering attempts that reference real transactions. Project drawings and agreements may reveal commercial relationships that competitors or fraudsters could exploit. Employees or contractors whose personal information sits inside those files face the usual secondary risks of identity misuse or targeted phishing. For the organisation itself, the exposure of proprietary designs and financial audits can damage competitive position and client trust, and may trigger regulatory notification duties depending on the jurisdictions involved. Because the number of people affected is unknown and the full data set has not been independently examined, the scale of these risks cannot yet be quantified.

What to do if you're exposed

If you have worked with, supplied, or been employed by Av Alumitran, treat the listing as a prompt to review your own exposure rather than as confirmed proof that your data is public. Monitor bank and credit-card statements for unfamiliar charges, and be sceptical of any unexpected messages that reference real invoices or projects. Consider placing fraud alerts with credit-reference agencies if you believe payment or identity data may be involved. Change passwords on any accounts that reused credentials associated with the company, and enable multi-factor authentication where available. Finally, you can run a free exposure scan of your email address against known breach data sets to check whether your information has already surfaced elsewhere; that step provides a practical baseline while further details about this incident remain limited.

AICompiled with AI assistance from public sources and published under our editorial standards.