Ferretti Construction Listed by akira Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ferretti Construction, an Italian engineering and construction company, was listed on January 16, 2026, by the Akira ransomware group. The listing states that internal files were exfiltrated during a ransomware attack, with the group claiming it will upload 66 GB of corporate data. The number of individuals affected remains unknown, and no independent confirmation of the data volume or contents has been made public.

The incident matters because Ferretti Construction handles large-scale industrial projects that routinely involve employee records, contracts, financial documents and project files. Any confirmed exposure of such material would affect both the company’s operations and the privacy of its personnel and partners.

Inside the incident

The only confirmed public information is the listing itself. Akira claims to have obtained internal files and states it intends to publish 66 GB of material. No date of the intrusion, method of access, or details on encryption have been disclosed. The scale of any operational disruption to Ferretti Construction is also unreported.

Inside akira

Akira is a ransomware operation that first appeared in early 2023. It is known for double-extortion tactics: encrypting systems and exfiltrating data before demanding payment. The group maintains a leak site where it lists victims and threatens to release stolen files if ransom demands are not met. Its targets have included organisations in manufacturing, construction, legal services and local government. Public reporting has documented Akira’s use of common initial-access techniques such as compromised remote-desktop services and phishing, followed by rapid lateral movement and data theft.

Ferretti Construction and its sector

Ferretti Construction is described as an Italian firm with approximately 100 years of activity in industrial construction. Its services encompass basic and detailed engineering, construction execution, and project and construction management. Companies of this type maintain extensive records on employees, subcontractors, clients and suppliers, as well as technical drawings, cost estimates and contractual documents that often span multiple jurisdictions and decades.

What was likely exposed

The Akira listing claims the exfiltrated material includes detailed employee information such as passports and driver’s licences, financial records, confidentiality agreements, contracts, project files and non-disclosure agreements. The facts provided to date do not include an independent inventory of the data. Therefore the precise contents remain unconfirmed.

What's at stake

Exposure of employee identity documents can facilitate identity theft or targeted fraud. Release of contracts and financial information may reveal commercial terms or competitive details to other parties. For the organisation, any confirmed data loss adds regulatory, legal and remediation costs even if operational systems are restored. Because the number of affected individuals is unknown, the full scope of personal impact cannot yet be assessed.

Were you affected?

Individuals who worked with or for Ferretti Construction should monitor their personal accounts and financial statements for unusual activity. A practical first step is to review any recent communications from the company about the incident. Readers can also run a free exposure scan of their email address against known breach data sets to check whether their information has appeared in previously published leaks.

AICompiled with AI assistance from public sources and published under our editorial standards.