The Cherokee Group Listed by akira Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

The Cherokee Group, a manufacturer of precast concrete wall panels operating under the Fabcon name, was listed on February 20, 2026, by the Akira ransomware group. The listing states that internal files were exfiltrated during a ransomware attack, with the group indicating it intends to upload corporate data. The number of individuals affected remains unknown, and no independent confirmation of the data’s release or contents has been made public. This incident occurs against a backdrop of sustained ransomware activity targeting industrial and construction firms, where threat actors continue to exploit supply-chain dependencies and hold operational data for leverage.

What happened

The Akira group added The Cherokee Group to its leak site on February 20, 2026. The post asserts that corporate files were taken during a ransomware intrusion and that additional material would be published. No details on the timing of the intrusion, the volume of data, or the method of initial access have been disclosed. The organization has not issued a public statement confirming or denying the claims.

Who is akira?

Akira is a ransomware operation that emerged in early 2023 and has since conducted intrusions against organizations in multiple countries. Public reporting describes the group as using double-extortion tactics, encrypting systems while also copying data for later disclosure or sale. The group maintains a leak site where it lists victims and, in some cases, posts samples of claimed material. Its targeting has included manufacturing, construction, and professional-services entities.

The Cherokee Group and its sector

The Cherokee Group operates as Fabcon, producing and installing precast concrete wall panels for industrial, commercial, and residential buildings. Projects range from small machine shops to large distribution centers and multi-story housing. Organizations in this sector routinely maintain project specifications, engineering drawings, client contracts, and employee records necessary for fabrication, transport, and on-site erection.

What was likely exposed

The Akira listing claims internal files were taken, including employee personal documents such as passports and driver’s licenses, financial records, project files, drawings, specifications, and nondisclosure agreements. The exact contents and scope remain unconfirmed by any independent source.

• Employee identity documents
• Financial records
• Project drawings and specifications
• Contractual and NDA materials

The real-world impact

Individuals whose identity documents appear in the claimed data face a modest increase in the risk of targeted fraud or account takeover attempts. For the organization, the exposure of project specifications and client-related files could affect competitive positioning or contractual relationships, though the practical consequences depend on whether and when any material is actually published. No evidence of immediate operational disruption beyond the initial listing has been reported.

Were you affected?

Begin by monitoring official communications from The Cherokee Group or Fabcon for any guidance on affected individuals. Review recent account statements and credit reports for unusual activity. A free exposure scan of your email address against known breach repositories can indicate whether your information has appeared in previously published data sets from other incidents.

AICompiled with AI assistance from public sources and published under our editorial standards.