Mettler Partner Listed by akira Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware operations continue to target organisations across sectors, often combining encryption with data theft to pressure victims. In this case, the Akira group listed Mettler Partner on its leak site on 21 January 2026, stating that internal files had been taken during a ransomware attack. The number of people affected remains unknown, and no confirmation of the claimed data volume or subsequent publication has been made public.

What happened

The incident centres on a ransomware attack in which files were allegedly exfiltrated from Mettler Partner. The Akira group added the company to its leak site on 21 January 2026 and stated that corporate data would be uploaded. No further details on the date of the intrusion, the encryption of systems, or any ransom demand have been disclosed. The scale of the operation and whether any data were later released remain unconfirmed.

The group behind it: akira

Akira is a ransomware operation that emerged in early 2023 and has since conducted intrusions against companies in multiple countries. Public reporting describes its use of double-extortion tactics, in which data are copied before encryption, followed by threats to publish the material if payment is not received. The group maintains a leak site where it lists victims and sometimes posts samples or descriptions of stolen files. Its listings constitute claims by the actor; independent verification of the contents or the circumstances of each incident is not provided by the group.

About Mettler Partner

Mettler Partner provides electrical planning, consulting, and creative lighting design services focused on sustainable and aesthetically integrated solutions for architectural projects. Organisations of this type routinely manage detailed project documentation, client specifications, technical drawings, and internal administrative records. A breach at such a firm can expose both operational information and personal data belonging to employees and, in some cases, clients or contractors.

What data was at risk

The Akira listing states that employee passports, HR information, projects, and additional internal files were taken. No independent inventory of the material has been released, and the precise categories or volume of data remain undisclosed by the company. Organisations in the electrical and lighting sector commonly hold employee identification documents, payroll and benefits records, project contracts, and correspondence; however, whether any of these specific items were present in the exfiltrated material has not been confirmed.

The real-world impact

Exposure of passport details and HR records can create opportunities for identity misuse or targeted fraud against individuals. Project files may contain proprietary technical information or client data whose disclosure could affect commercial relationships or regulatory compliance. For the organisation, the incident adds operational disruption from any recovery efforts and potential scrutiny from clients or regulators. The absence of confirmed publication or a known count of affected individuals limits the ability to quantify these risks at present.

If your data was in this claimed breach

Individuals who believe their information may have been involved should monitor bank and government accounts for unusual activity and consider placing fraud alerts with credit agencies where available. Changing passwords for any linked services and enabling multi-factor authentication remain basic protective steps. Readers can run a free exposure scan of their email address against known breach data sets to check for prior appearances of their information.

AICompiled with AI assistance from public sources and published under our editorial standards.