Consonic Listed by akira Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On 9 April 2025 the ransomware group known as akira listed Consonic on its leak site and claimed to hold more than 26 GB of the company’s internal files. For employees, customers and partners whose contact details, correspondence or financial records may sit inside that material, the practical stakes are straightforward: the data could be used for targeted phishing, social-engineering calls or attempts at fraud.

Public detail remains limited. The number of people affected is unknown, and independent confirmation of the claim has not been published. What is known is the group’s assertion that it is ready to release the files and the kinds of documents it says are included.

Inside the incident

According to the listing dated 9 April 2025, akira states that it has exfiltrated internal files from Consonic in a ransomware attack and is prepared to upload more than 26 GB of corporate documents. The group’s own description of the material names contact numbers and e-mail addresses of employees and customers, internal corporate correspondence, and financial data such as audits, payment details and reports. No further technical details—how the intrusion occurred, when it began, or whether systems were encrypted—have been disclosed in the available record. The scale of any impact on individuals is likewise unconfirmed.

Who is akira?

Akira is a ransomware operation that became publicly active in 2023. Like many contemporary groups it practises double extortion: after gaining access it both encrypts systems and steals data, then threatens to publish the stolen material on a dedicated leak site if a ransom is not paid. The group has previously listed organisations across manufacturing, professional services and other sectors, typically posting sample files or volume claims to pressure victims. Its listing of Consonic is therefore a claim made by the actors themselves; it has not been independently verified in the public record surrounding this incident.

Who is Consonic?

Consonic is an engineering-solutions provider with a stated 50-year history serving the Australian and New Zealand automotive, plastic-processing, packaging, food-processing and medical industries. Companies of this type routinely hold supplier and customer contact lists, project correspondence, technical drawings, commercial contracts and financial records. A breach involving such material can affect not only the organisation’s own staff but also the wider supply chain that relies on those relationships and documents.

The information in question

The only data types named in the public listing are “internal files” said to have been exfiltrated. The group further claims the archive contains the following categories:

• contact numbers and e-mail addresses of employees and customers
• internal corporate correspondence
• financial data including audits, payment details and reports

Exact contents, file counts and whether any of the material has actually been published remain unconfirmed. Organisations operating in engineering and manufacturing typically store precisely these kinds of records; until independent verification appears, the precise exposure cannot be stated as fact.

Why it matters

If the claimed data are accurate, individuals whose names, phone numbers or e-mail addresses appear in the files face elevated risk of spear-phishing and social-engineering attempts that reference real colleagues or projects. Financial records could enable invoice fraud or attempts to redirect payments. For Consonic itself the release of internal correspondence and commercial documents could expose negotiating positions, pricing or technical information to competitors or opportunistic actors. Because the number of people affected is unknown, the full extent of these risks cannot yet be measured, but the categories listed are those most commonly exploited in follow-on fraud.

Were you affected?

Anyone who has worked with or for Consonic should treat unsolicited messages that reference the company or its projects with caution. Practical first steps include monitoring bank and credit-card statements for unexpected activity, enabling multi-factor authentication on e-mail and financial accounts, and verifying any payment-change requests through a known, independent channel. Readers can also run a free exposure scan of their e-mail address to check whether that address has already appeared in other known breach data sets; a positive result does not prove involvement in this incident, but it supplies an additional data point for personal vigilance.

AICompiled with AI assistance from public sources and published under our editorial standards.