IPM Group (Multimedia Information & Production Company) Listed by akira Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to target media and technology firms as part of a broader pattern of double-extortion attacks that combine encryption with data theft and public leak threats. In this environment, even listings on criminal leak sites can create lasting uncertainty for organisations and the people connected to them.

On 4 June 2024 the ransomware group known as akira listed IPM Group, a Belgian multimedia and internet-services company, on its leak site. The group claimed to have taken internal files and said it would release approximately 40 GB of data. Public detail on the incident remains limited to that claim; the number of people affected is unknown and independent confirmation of the full scope has not been published.

What happened

According to the listing published by akira, IPM Group was the victim of a ransomware attack in which internal files were exfiltrated. The group stated that it would share 40 GB of data and described the material as including internal business files containing financial information, contracts, employee files, confidential agreements and information about some Belgian media companies. No further technical details—such as the initial access method, the precise date of intrusion, or whether systems were encrypted—have been disclosed in the available record. The number of individuals whose information may have been involved is listed as unknown. The listing itself constitutes an unverified claim by the threat actor; no public confirmation from IPM Group or independent investigators has been included in the facts provided.

Inside akira

Akira is a ransomware operation that became publicly active in 2023. Like many contemporary groups, it typically employs a double-extortion model: after gaining access to a network it steals data, encrypts systems where possible, and then threatens to publish the stolen material on a dedicated leak site if a ransom is not paid. The group has been observed targeting organisations across multiple sectors and geographies, often focusing on mid-sized enterprises that hold commercially sensitive or personal information. Public reporting has documented its use of common initial-access techniques such as compromised credentials and exploitation of exposed remote-access services, followed by lateral movement and data staging. When victims do not negotiate, akira posts sample files or full archives on its dark-web site. In the present case the group’s listing of IPM Group and the accompanying description of 40 GB of internal files should be treated as a claim rather than independently verified fact.

About IPM Group (Multimedia Information & Production Company)

IPM Group is a major Belgian media and internet-services company active in news, entertainment, advertising, gaming and innovation. Organisations of this type typically manage large volumes of editorial content, advertising contracts, audience data, employee records and commercial agreements with other media partners. Because media companies sit at the intersection of public information and private commercial relationships, a breach can affect not only the firm’s own staff and partners but also the wider media ecosystem in which it operates. The potential exposure of contracts and information about other Belgian media companies therefore carries implications beyond a single corporate network.

What data was at risk

The only data types named in the available record are those claimed by akira: internal business files said to contain financial information, contracts, employee files, confidential agreements and information about some Belgian media companies. The group further asserted that the total volume would be approximately 40 GB. Exact contents, file counts and whether any of the material has actually been released remain unconfirmed. Media and production companies commonly hold payroll and human-resources records, supplier and client contracts, financial statements, internal strategy documents and correspondence with partner outlets. While such categories align with the types of files the group listed, the precise composition of any exfiltrated archive has not been independently verified and should be regarded as unconfirmed.

What's at stake

For employees whose files may have been taken, the practical risks include identity fraud, phishing campaigns that reference real employment details, and long-term exposure of personal contact or financial information. Contractual and financial documents, if authentic, could be used for competitive intelligence, social-engineering attacks against partners, or further extortion attempts. Confidential agreements and information about other Belgian media companies raise the possibility of secondary harm to organisations that never directly interacted with the attackers. For IPM Group itself the consequences include potential regulatory scrutiny under European data-protection rules, reputational damage, disruption of commercial relationships and the cost of investigation and remediation. Because the number of affected individuals is unknown and the full contents of the claimed archive remain unverified, the exact scale of harm cannot yet be measured; the uncertainty itself, however, is a concrete operational and personal burden.

Were you affected?

If you are a current or former employee, contractor or partner of IPM Group, treat any unexpected communications that reference internal company details with caution. Monitor financial accounts and credit reports for unusual activity, enable multi-factor authentication on personal and work accounts, and consider placing fraud alerts with relevant credit bureaux. Organisations that hold contracts or share data with IPM Group should review access logs and watch for targeted phishing. Readers can also run a free exposure scan of their email address to check whether their information has already appeared in known breach data sets. Public detail on this incident remains limited; further official statements from the company or regulators, if they appear, will provide the most reliable guidance.

AICompiled with AI assistance from public sources and published under our editorial standards.