Manko Window Systems Listed by akira Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Manko Window Systems, a manufacturer of commercial windows, aluminum systems, and glass products, was listed on October 17, 2025, by the ransomware group known as akira. Public reporting states that internal files were exfiltrated in a ransomware attack, though the number of people affected remains unknown and independent confirmation of the full scope is limited.

The listing itself is a claim by the group, which asserted it was ready to upload 20 GB of corporate documents. For individuals and partners connected to the company, the episode raises practical questions about what information may have left the network and what steps can reduce follow-on risk.

Inside the incident

According to the available record, Manko Window Systems appeared on akira’s leak site on October 17, 2025. The group claimed it had exfiltrated internal files and was prepared to release approximately 20 GB of corporate documents. No further technical details—such as the initial access method, the precise date of intrusion, or whether encryption was also deployed—have been publicly disclosed. The volume of people affected is listed as unknown. Beyond the group’s own statements, independent verification of the data’s authenticity or completeness has not been reported.

The claim specifically referenced client personal information (including Social Security numbers, dates of birth, phone numbers and other documents), employee information, accounting and financial records, project files, drawings and specifications, detailed product information, and non-disclosure agreements. These assertions remain unverified claims originating from the threat actor’s listing.

Who is akira?

Akira is a ransomware operation that has been active in public reporting since early 2023. The group typically follows a double-extortion model: it encrypts systems while also copying data and threatening to publish it on a dedicated leak site if a ransom is not paid. Akira has targeted organizations across manufacturing, professional services, and other sectors, often gaining access through compromised credentials, exposed remote-access services, or known software vulnerabilities. Once inside, operators commonly move laterally, escalate privileges, and stage large volumes of data for exfiltration before deploying ransomware.

The group’s leak site functions as both a pressure mechanism and a public claim of responsibility. Listings frequently include sample file names or volume estimates, as occurred in this case. Because such posts are self-reported by the attackers, they should be treated as claims rather than What's Publicly Reported until corroborated by the victim or independent investigators.

Who is Manko Window Systems?

Manko Window Systems is described in public materials as a manufacturer of commercial windows, aluminum systems, and glass products. Companies in this sector design, fabricate, and supply building components used in commercial construction projects. They typically maintain records of clients (architects, contractors, building owners), employees, suppliers, project drawings, product specifications, financial accounts, and contractual documents such as NDAs.

A breach at a manufacturer of this type can affect not only the firm’s own workforce but also external parties whose personal or commercial data appears in project files, invoices, or correspondence. Because construction and building-product firms often hold detailed technical drawings and client contact information, the potential exposure extends beyond pure financial records.

What data was at risk

The only data types named in the public record are “internal files exfiltrated in a ransomware attack.” The akira listing further claims the material includes client personal information (Social Security numbers, dates of birth, phone numbers and other documents), employee information, accounting and financials, projects, drawings and specifications, detailed product information, and NDAs, totaling roughly 20 GB. These specifics originate solely from the threat actor and have not been independently confirmed.

Organizations of this kind commonly hold employee payroll and HR files, customer contact and contract data, engineering drawings, pricing and financial ledgers, and supplier records. Whether any particular category was actually taken remains unconfirmed. Public detail on exact file contents, the number of individuals involved, or the presence of full Social Security numbers is therefore limited to the group’s unverified assertions.

Why it matters

If the claimed data is authentic, individuals whose personal identifiers appear in client or employee files could face elevated risks of identity theft, targeted phishing, or fraudulent account openings. Construction-related project files and product specifications may also contain commercially sensitive information that competitors or other parties could misuse. For the company itself, the incident can disrupt operations, strain client relationships, and trigger regulatory or contractual notification obligations once the facts are clarified.

Even when the precise contents remain unconfirmed, the mere listing by a known ransomware group creates lasting uncertainty. Affected people cannot assume the data is safe simply because no further public dump has been observed; threat actors sometimes sell or reuse material privately.

What to do if you're exposed

Anyone who has worked with or for Manko Window Systems, or who appears in its client or project records, can take several concrete steps while official details remain limited:

• Monitor bank, credit-card, and credit-report activity for unexpected inquiries or accounts.
• Place a free fraud alert or credit freeze with the major credit bureaus if Social Security numbers or other identifiers may be involved.
• Treat unsolicited emails, calls, or texts that reference the company or recent projects with heightened caution; verify any request through a known official channel.
• Change passwords on accounts that reused credentials possibly stored in corporate systems, and enable multi-factor authentication wherever available.
• Retain any official breach notification you receive and follow the specific guidance it contains.

Readers can also run a free exposure scan of their email address to check whether that address has already appeared in known breach data sets. Doing so provides an additional, independent signal while waiting for further confirmed information from the company or investigators.

AICompiled with AI assistance from public sources and published under our editorial standards.