Susquehanna Glass Listed by akira Ransomware Group: Ransomware Claim — What’s Alleged & What To Do
Susquehanna Glass was listed by the Akira ransomware group on December 02, 2025, after internal files were exfiltrated in a ransomware attack. The number of people affected is not yet known; anyone connected to the company should review any communications from Susquehanna Glass and monitor their accounts for unusual activity.
Breaking down the breach
The incident centers on a claim by the Akira group that it obtained corporate data from Susquehanna Glass. No official statement from the organization has been referenced in available records, and details such as the date of the intrusion, the method of access, or the total volume of data remain undisclosed. The group indicated it would publish approximately 35 gigabytes of material, but no confirmation of any subsequent upload exists at this time.
Inside akira
Akira is a ransomware group that has conducted operations against organizations in multiple sectors since at least 2023. Public reporting on the group describes a pattern of encrypting systems while also copying data for potential publication on a dedicated leak site. The group typically contacts victims to demand payment in exchange for a decryptor and assurances that stolen files will not be released. Its listings function as a pressure tactic when negotiations stall or fail.
About Susquehanna Glass
Susquehanna Glass is a family-owned company now led by third-generation owner Walt Rowen. Businesses of this type maintain records related to employees, customers, suppliers, and financial operations. Such records commonly include forms required for employment verification, identification documents, and transaction histories. A compromise at an organization holding these categories of information can affect both internal operations and individuals whose details appear in the files.
What was likely exposed
The Akira group claims to have obtained internal files containing personal information belonging to nearly 800 people, along with financial and customer records. The organization itself has not confirmed the contents of any exfiltrated data, so the precise scope remains unverified. Typical records held by an employer in this sector include employment eligibility documents and identification materials, but the exact items cannot be stated as fact.
- I-9 forms
- Scans of passports and driver’s licenses
- Social Security numbers
- Drug test results
- Financial and customer information
The real-world impact
Individuals whose personal identifiers appear in the claimed data face the possibility of identity misuse, including fraudulent tax filings or account openings. The organization may encounter regulatory inquiries and costs associated with notification and remediation. Because the number of affected people is not yet known, the full extent of these consequences cannot be quantified at present.
What to do if you're exposed
Monitor financial accounts and credit reports for unusual activity. Place a fraud alert or credit freeze with the major bureaus if personal identifiers such as Social Security numbers are believed to be involved. Readers can run a free exposure scan of their email address to check whether their information has appeared in known breach data sets. Organizations should follow established incident-response procedures and consult legal and cybersecurity advisors for next steps.
AICompiled with AI assistance from public sources and published under our editorial standards.
How this breach connects
More recent breaches
Taylor Clay Products Listed by akira Ransomware GroupWatertech of America, WorldPoint ECC, Mastermedia, Garrett Leather, Guttenberg Industries. Listed by akira Ransomware GroupSteel Dynamics Listed by akira Ransomware GroupAssociated Thermoforming Listed by akira Ransomware GroupLatest breaches
Read GalaxyWarden’s full analysis of the Susquehanna Glass Listed by akira Ransomware Group →
Publicly posted by akira — unverified claim, pending independent verification
Breach listings — particularly those originating from ransomware or leak sites — are third-party claims that may be unverified, incomplete, or inaccurate. A listing does not by itself confirm that a breach occurred or that any specific data was exposed. Severity is an automated assessment, not a definitive rating. Verification status is shown where available.
Attributions to threat groups and methods reflect public reporting and, in some cases, unverified claims made by the groups themselves; they may be incomplete or later revised. Recent Breaches and GalaxyWarden are independent and are not affiliated with, and do not endorse, any company or group named on this page. This information is aggregated from public sources for awareness only and is not legal, security, or investment advice.