CNQC Listed by akira Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to target large enterprises across construction, real estate and related sectors, often claiming to have stolen substantial volumes of internal records before posting victims on leak sites. In this environment, listings by established actors such as akira serve as public signals that an organisation may have suffered data theft, even when independent confirmation remains limited.

On March 12, 2025, CNQC was listed by the akira ransomware group. Public detail on the incident is limited: the number of people affected is unknown, and the only confirmed characterisation of the exposure is that internal files were allegedly exfiltrated in a ransomware attack. The listing itself is a claim by the group, which stated it was ready to upload more than 90 GB of corporate documents. This matters because CNQC operates in construction, investment and real-estate activities that routinely involve sensitive employee, customer and financial records; any confirmed exposure could create lasting risks for those individuals and for the organisation’s operations.

Breaking down the breach

According to the available record, CNQC appeared on the akira leak site on March 12, 2025. The incident is described as a ransomware attack in which internal files were allegedly exfiltrated. No public information has been released about the precise date of intrusion, the initial access method, the duration of the attackers’ presence, or whether systems were encrypted in addition to data theft. The number of people affected remains unknown. The group’s listing asserts that it holds more than 90 GB of material and is prepared to publish it; that assertion has not been independently verified in the public record. Beyond the statement that internal files were taken, further technical or forensic detail is undisclosed.

The group behind it: akira

Akira is a ransomware operation that has been active since early 2023 and is known for double-extortion tactics: encrypting systems while simultaneously stealing data and threatening to publish it on a dedicated leak site if a ransom is not paid. The group typically targets mid-sized and larger organisations across multiple sectors, often gaining initial access through compromised credentials, phishing or unpatched remote-access services. Once inside, operators move laterally, exfiltrate data and deploy ransomware. Victims are then listed on the group’s dark-web portal with sample files or volume claims intended to pressure payment. Prior public activity by akira has included numerous construction, manufacturing and professional-services firms. In the present case, the group claims to possess more than 90 GB of CNQC material and lists specific document categories; those claims should be treated as unverified assertions rather than What's Publicly Reported.

Who is CNQC?

CNQC was established in 1952 and is engaged in domestic and international construction projects, investment, real-estate development, capital management, logistics, design consulting and related activities. Organisations of this type typically manage large volumes of project documentation, employee records, financial statements, contracts with clients and suppliers, and personal data belonging to staff and customers. A breach involving such an entity is consequential because construction and real-estate firms often hold identity documents, medical information, payment details and contact data that can be reused for fraud, identity theft or further social-engineering attacks. Disruption of internal systems can also affect ongoing projects, contractual obligations and regulatory compliance obligations that apply to firms handling personal and financial information.

The information in question

The public record states that internal files were exfiltrated. The akira group claims the material includes more than 90 GB of essential corporate documents such as driver licences, employees’ medical forms, financial data (audits, payment details, reports), rental agreements, contact numbers and e-mail addresses of employees and customers, and employment passports with fingerprints. These categories are presented solely as the group’s assertion; the exact contents of any stolen archive have not been independently confirmed. Organisations in the construction and real-estate sector commonly hold precisely these kinds of records—identity documents, health-related forms for staff, financial audits, contracts and contact lists—so the claimed data types are consistent with the firm’s business, yet remain unconfirmed pending further disclosure or verification.

The real-world impact

If the claimed data were released or sold, individuals whose driver licences, medical forms, passport details or contact information appear could face elevated risks of identity theft, medical fraud, phishing and targeted scams. Financial records and payment details could enable invoice fraud or unauthorised transactions. For CNQC itself, the exposure of internal audits, rental agreements and customer lists could damage commercial relationships, trigger contractual or regulatory scrutiny, and require costly remediation, notification and monitoring efforts. Because the number of affected people is unknown and the precise contents remain unconfirmed, the full scale of harm cannot yet be quantified; the primary immediate risk is the potential misuse of any personal or financial data that may have left the organisation’s control.

Were you affected?

If you are a current or former employee, customer or contractor of CNQC, monitor financial accounts and credit reports for unusual activity, be alert to unexpected requests for personal information, and consider placing fraud alerts where available. Change passwords on any accounts that may have reused credentials linked to work e-mail. Readers can also run a free exposure scan of their e-mail address to check whether that address has already appeared in known breach data sets. Official notifications, if any, will come from CNQC or relevant authorities; until then, treat any unsolicited contact claiming to relate to this incident with caution.

AICompiled with AI assistance from public sources and published under our editorial standards.