Northern Air Systems(2) Listed by akira Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Northern Air Systems(2), a manufacturer of HVAC systems, was listed on December 11, 2025, by the Akira ransomware group. The listing states that internal files were exfiltrated during a ransomware attack. The number of individuals affected has not been disclosed.

The incident is significant because the organization handles commercial and industrial client records, employee documentation, and project-related materials. Any confirmed exposure of such data would affect privacy and operational confidentiality in a sector that serves critical infrastructure clients.

Inside the incident

The Akira group claims this was its second successful intrusion into Northern Air Systems(2) systems. According to the listing, the attackers encrypted nearly 90 virtual machines and exfiltrated approximately 150 GB of data, described as five times the volume taken in the prior incident. The group states it intends to publish the files. No independent confirmation of these figures or of the encryption scope has been made public, and the organization has not released a statement on the matter.

The group behind it: akira

Akira is a ransomware operation that first appeared in early 2023 and has since conducted numerous attacks against organizations in North America and Europe. The group typically employs double-extortion tactics, encrypting systems while also copying data for later publication if a ransom is not paid. Its listings frequently include claims about the volume and sensitivity of stolen material. Public reporting has linked Akira to the reuse of known initial-access techniques such as compromised remote-desktop services and unpatched vulnerabilities, though the precise entry method in any single case is rarely confirmed by victims.

About Northern Air Systems(2)

Northern Air Systems(2) has operated for nearly three decades as a manufacturer of high-quality HVAC equipment for commercial and industrial applications. Companies in this sector routinely maintain records on equipment installations, maintenance contracts, client specifications, and regulatory compliance documentation. They also hold employee records required for hiring, safety certifications, and benefits administration. A breach at such a firm can therefore touch both business relationships and personal information belonging to staff and customers.

What was likely exposed

The Akira listing claims that the exfiltrated material includes detailed employee information such as I-9 forms, passports, driver’s licenses, medical information, and photographs, along with client data containing driver’s licenses, addresses, and email addresses. It further states that financial records, project files, contracts, agreements, and nondisclosure agreements were taken. The organization itself has not confirmed these descriptions, and the precise contents of any files remain unverified beyond the group’s assertions.

What's at stake

Exposure of government-issued identification documents and medical details can enable identity theft or targeted fraud against individuals. Client contact information and project records could be used for competitive intelligence or further social-engineering attempts against the same customers. For the company, the release of contracts and financial data may complicate ongoing business relationships and regulatory compliance obligations, even if the operational impact of the encryption has not been quantified publicly.

If your data was in this claimed breach

Individuals who have worked with or been employed by Northern Air Systems(2) should monitor their financial accounts and credit reports for unusual activity. Enabling multi-factor authentication on email and other important accounts reduces the value of any exposed credentials. A free exposure scan of an email address against known breach data sets can indicate whether personal information has already appeared in public listings from this or other incidents.

AICompiled with AI assistance from public sources and published under our editorial standards.