Mermet Listed by akira Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On March 27, 2024, the ransomware group known as akira listed Mermet on its leak site, claiming responsibility for a ransomware attack in which internal files were exfiltrated. Public detail remains limited: the number of people affected is unknown, and independent confirmation of the full scope has not been released. The group stated that roughly 30GB of data would be made available, including confidential HR files containing personal information and other company material.

For an organisation that manufactures fabrics for customers, any exposure of internal and HR records raises practical concerns for employees and partners whose details may have been among the files. What is known so far rests primarily on the group’s own listing rather than a detailed public disclosure from Mermet itself.

What happened

According to the reported listing, Mermet was the target of a ransomware attack in which internal files were taken. The claim appeared on March 27, 2024. The group asserted that about 30GB of data would be published soon and specifically mentioned confidential HR files with personal information along with other material described as interesting to the company. No further public detail has been provided on the precise timing of the intrusion, the technical method used, the total volume of systems affected, or whether encryption of operational systems occurred alongside the claimed exfiltration. The number of individuals whose data may be involved remains unknown. The listing itself constitutes an unverified claim by the threat actor pending any confirmation or fuller statement from the organisation.

Inside akira

Akira is a ransomware operation that became publicly active in 2023. Like many contemporary ransomware groups, it typically follows a double-extortion model: operators gain access to a network, exfiltrate data, encrypt systems, and then threaten to publish the stolen material on a dedicated leak site if a ransom is not paid. The group has targeted organisations across multiple sectors and geographies, often posting victim names and sample descriptions of the data it claims to hold. Its leak-site postings are public claims rather than independently verified inventories; they serve both as pressure on the victim and as advertising of the group’s activity. Public reporting has associated akira with relatively rapid operations and with the use of common initial-access vectors such as compromised credentials or exposed remote services, though the specific path used against any single victim is rarely disclosed by the group itself. In this case, the only statements attributed to akira about Mermet are those contained in the listing: the assertion of a ransomware attack, the planned release of approximately 30GB of internal files, and the reference to confidential HR material and other company data.

Who is Mermet?

Mermet is a company dedicated to producing quality fabrics intended to meet and exceed customer expectations. Organisations of this type typically operate manufacturing facilities, maintain supply-chain relationships, and hold internal records covering employees, contractors, customers, and commercial operations. Fabric manufacturers often store personnel files, payroll and benefits data, health or safety documentation, supplier contracts, product specifications, and customer order histories. A breach involving such an organisation is consequential because the data sets can include personally identifiable information of staff and, potentially, commercial details that affect partners or clients. Even when the exact contents remain unconfirmed, the presence of HR files in a claimed dump raises the possibility that ordinary employees—rather than only executives or public-facing contacts—could be affected.

The information in question

The facts available name the exposed material as internal files exfiltrated in a ransomware attack. The group’s listing further claims that about 30GB of data would be released and that it would include confidential HR files containing personal information together with other company material. Exact file inventories, the full range of data categories, and the number of individuals involved have not been independently confirmed and remain undisclosed beyond these statements. Organisations in the textile and fabric sector commonly hold employee names, addresses, national identifiers or tax numbers, bank details for payroll, performance records, and sometimes medical or emergency-contact information, as well as commercial documents. Whether any of those categories appear in the claimed 30GB set is unconfirmed; the only concrete description provided is the group’s own reference to confidential HR files with personal information and additional internal material.

Why it matters

For people whose information may have been among the files, the practical risks include identity theft, targeted phishing that references real employment details, and possible misuse of financial or contact data. HR records are particularly sensitive because they often combine identifiers that are difficult to change with information about employment status, salary, or personal circumstances. For the organisation, the consequences can include regulatory notification obligations, potential legal exposure if personal data of employees or others was involved, disruption of internal operations, and damage to trust with staff and commercial partners. Because the scale of the incident and the precise contents remain unconfirmed, the full extent of these risks cannot yet be quantified, but the mere claim of HR-file exposure is sufficient to warrant caution among anyone connected to Mermet.

Were you affected?

If you are a current or former employee, contractor, or partner of Mermet, treat the possibility of exposure seriously even while public detail is limited. Practical first steps include the following:

• Monitor financial accounts and credit reports for unexpected activity.
• Be alert to phishing or social-engineering attempts that reference employment details or company names.
• Consider placing fraud alerts or credit freezes with major credit bureaus if you believe sensitive identifiers may have been involved.
• Change passwords on any accounts that reused credentials linked to work email or systems, and enable multi-factor authentication where available.
• Retain any official notifications from Mermet and follow guidance they provide once more information is released.

Readers can also run a free exposure scan of their email address to check whether that address has already appeared in known breach data sets. Such checks do not confirm or rule out involvement in this specific incident, but they can indicate whether an address has surfaced elsewhere and help prioritise further protective measures.

AICompiled with AI assistance from public sources and published under our editorial standards.