COSMED Listed by akira Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On 14 February 2025, the ransomware group known as akira listed COSMED on its leak site, claiming responsibility for a ransomware attack in which internal files were exfiltrated. Public detail remains limited: the number of people affected is unknown, and independent confirmation of the full scope has not been published. The listing itself is an unverified claim by the group.

COSMED is a privately owned manufacturer of cardio-pulmonary, metabolic and body-composition diagnostic equipment. Any confirmed exposure of corporate or personal records from such an organisation carries practical consequences for staff, partners and the company itself, which is why the claim warrants careful attention even while many specifics stay undisclosed.

What happened

According to the reported listing dated 14 February 2025, akira stated that it had conducted a ransomware attack against COSMED and exfiltrated internal files. The group further claimed it was prepared to upload more than 25 GB of corporate documents. No public information has confirmed the precise date of intrusion, the initial access method, whether encryption was deployed, or whether any ransom demand was paid. The volume of data, the exact file inventory and the number of individuals whose information may be involved all remain unconfirmed beyond the group’s own statements.

Who is akira?

Akira is a ransomware operation that has been active since early 2023. It typically employs a double-extortion model: encrypting systems while also stealing data and threatening to publish it on a dedicated leak site if payment is not received. The group has previously targeted organisations across manufacturing, professional services and other sectors, often using compromised credentials or known vulnerabilities for initial access, followed by lateral movement and data staging. Its leak-site postings are claims made by the operators themselves; they do not constitute independent verification of the breach or of the contents described. In this instance, the listing of COSMED should be treated as an assertion by akira rather than as confirmed fact.

COSMED and its sector

COSMED designs and manufactures specialised diagnostic equipment used for cardio-pulmonary testing, metabolic analysis and body-composition assessment. As a privately held company operating in the medical-device sector, it routinely handles technical documentation, regulatory filings, supplier contracts, employee records and financial material. Organisations of this type also maintain relationships with hospitals, clinics, research institutions and distributors, so internal systems may contain correspondence and commercial data linked to those partners. A breach claim against a medical-equipment manufacturer is consequential because the sector’s data often includes personally identifiable information of staff and contractors, proprietary technical files, and financial records whose compromise can affect both operational continuity and regulatory standing.

What was likely exposed

The facts state only that internal files were exfiltrated in a ransomware attack. The group’s own listing claims readiness to publish more than 25 GB of material and names several categories. Exact contents have not been independently verified, and the number of people affected remains unknown. Organisations manufacturing diagnostic medical equipment typically hold employee identity documents, contractual papers, financial audits and payment records; any such material, if present, would fall within the categories the group asserts. The concrete points claimed by akira are:

• passport scans
• NDAs and other confidential files
• financial data including audits, payment details and reports
• foreigner identity cards
• additional unspecified essential corporate documents

Until the data is examined by the organisation or by independent researchers, these remain unverified assertions rather than established facts.

Why it matters

If the claimed material is authentic, individuals whose passport scans, identity cards or personal details appear in the files face elevated risks of identity theft, targeted phishing and fraudulent account openings. Financial records and payment details could enable further fraud against the company or its counterparties. For COSMED itself, publication of NDAs, audits or proprietary documentation may create commercial, contractual and regulatory exposure. Even without confirmed encryption of production systems, the mere exfiltration of internal files can disrupt operations, require costly forensic review and notification processes, and erode trust among employees and business partners. Because the scale of affected individuals is unknown, the practical impact cannot yet be quantified, but the categories listed by the group are precisely those that produce lasting individual and organisational harm when they surface.

Were you affected?

If you are a current or former COSMED employee, contractor or partner and have reason to believe your personal or financial information may have been held by the company, take basic protective steps: monitor bank and credit accounts for unusual activity, enable multi-factor authentication on important online services, and be alert to unexpected messages that reference the company or request sensitive data. Consider placing a fraud alert with credit bureaux if identity documents are among the claimed files. Readers can also run a free exposure scan of their email address to check whether that address has already appeared in known breach data sets. Public detail on this incident is still limited; any official notification from COSMED or from regulators should be treated as the authoritative source of further guidance.

AICompiled with AI assistance from public sources and published under our editorial standards.