DELOPT Listed by akira Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

People whose personal or professional details sit inside DELOPT’s systems may now face real exposure. On 4 April 2025 the ransomware group known as akira listed the company on its leak site and claimed it had taken more than 70 GB of internal files. The number of individuals affected remains unknown, yet the types of material the group says it holds—employee and customer contact details, passports, contracts and financial records—carry lasting practical consequences for anyone named in them.

Public information is still limited to the group’s own posting. No independent confirmation of the theft’s full scale or of any subsequent data release has been published. For those who work with or buy from DELOPT, the immediate question is whether their own records are among the files the attackers claim to possess.

Breaking down the breach

According to the listing dated 4 April 2025, DELOPT was the target of a ransomware attack in which internal files were exfiltrated. The group states it is prepared to upload more than 70 GB of corporate material. Beyond that claim, details of the intrusion—how the attackers first gained access, whether systems were encrypted, the exact date of the compromise, or any ransom demand—have not been disclosed in public reporting. The number of people whose data may be involved is listed as unknown. What is known rests solely on the group’s assertion that it holds the material and is ready to publish it.

The group behind it: akira

Akira is a ransomware operation that has been active since early 2023. It typically employs a double-extortion model: encrypting a victim’s systems while simultaneously stealing data and threatening to publish it on a dedicated leak site if payment is not made. The group has previously targeted organisations across manufacturing, professional services, education and other sectors, often advertising stolen file volumes measured in tens or hundreds of gigabytes. Its leak site functions as both a pressure tool and a public catalogue of claimed victims. In the present case the listing of DELOPT is an unverified claim by the group; no independent verification that the data has been released or that the volume matches the stated 70 GB has been reported.

About DELOPT

DELOPT describes itself as a company specialising in defence electronics and electro-optics, as well as technology solutions for the retail sector, including in-store systems. Organisations of this kind routinely handle sensitive technical documentation, government or defence-related contracts, employee records, customer contact lists and financial information. Because defence-electronics work often involves controlled technologies and long-term supplier relationships, a breach can affect not only the company’s own staff and clients but also partners who share proprietary or regulated data. The retail side of the business may hold additional customer and point-of-sale related records. The combination of these two domains makes the potential exposure of internal files consequential for both national-security-adjacent work and ordinary commercial relationships.

What was likely exposed

The only data types named in the public record are “internal files exfiltrated in a ransomware attack.” The group’s own statement lists categories it claims to hold: corporate non-disclosure agreements, contact numbers and email addresses of employees and customers, corporate licences, agreements and contracts, financial data including audits, payment details and reports, as well as passports and other employee and customer documents. These remain claims made by the attackers. Exact contents, file counts and whether any of the material has actually been published have not been independently confirmed. Organisations operating in defence electronics and retail technology typically store precisely these kinds of records—identity documents for staff, contractual paperwork, financial statements and customer contact databases—so the claimed categories are consistent with what such a company would hold. That consistency, however, does not establish that every listed item was in fact taken or will be released.

Why it matters

For individuals, the practical risks are concrete. Email addresses and phone numbers can be used for targeted phishing or social-engineering attempts. Passport scans and other identity documents raise the possibility of identity fraud or unauthorised account openings. Financial details and payment records can facilitate fraud against both employees and customers. Contracts and NDAs, if published, may reveal commercial terms or personal obligations that were never intended for public view. For DELOPT itself, the exposure of internal licences, agreements and technical documentation can damage supplier and customer trust, complicate ongoing defence-related work, and create regulatory or contractual liabilities. Because the number of affected people is unknown, the full scope of these risks cannot yet be measured; the absence of confirmed numbers does not reduce the seriousness of the categories of data the attackers claim to possess.

Were you affected?

If you are a current or former employee, customer or partner of DELOPT, treat the possibility of exposure seriously until more information becomes available. Monitor financial accounts and credit reports for unusual activity, be alert to unexpected emails or calls that reference the company or personal details, and consider changing passwords on any accounts that may have shared credentials or recovery information with DELOPT systems. You can also run a free exposure scan of your email address to check whether it has already appeared in known breach data sets. Official notifications from DELOPT, if and when they are issued, will provide the most reliable guidance on next steps.

AICompiled with AI assistance from public sources and published under our editorial standards.