Thong Sia Listed by akira Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On 17 February 2025, the organisation Thong Sia was listed on a leak site operated by the ransomware group known as akira. Public reporting indicates that internal files were exfiltrated in a ransomware attack, though the number of people affected remains unknown and many operational details have not been confirmed. The listing matters because Thong Sia serves as a regional distributor of well-known watch and clock brands across several Asian markets, meaning any exposure of corporate or personal records could affect employees, customers and business partners.

akira has stated that it is prepared to publish a substantial volume of sensitive material. As with any such claim posted by a threat actor, the assertion itself has not been independently verified in the available public record.

Inside the incident

The sole confirmed public marker of the incident is the 17 February 2025 listing of Thong Sia by akira. According to the group’s own statement, internal files were taken during a ransomware attack. No further technical details—such as the initial access vector, the precise date of intrusion, the volume of data removed, or whether encryption was also deployed—have been disclosed in the material available. The number of individuals whose information may have been involved is likewise unreported. The group claims it is ready to upload a large quantity of corporate documents, but that claim has not been corroborated by independent sources.

The group behind it: akira

akira is a ransomware operation that has been active since early 2023 and is known for double-extortion tactics: encrypting systems while simultaneously exfiltrating data and threatening to publish it if a ransom is not paid. The group typically targets mid-sized and larger organisations across manufacturing, professional services, healthcare and other sectors, often gaining entry through compromised credentials, vulnerable remote-access services or unpatched software. Once inside, operators move laterally, steal data and then deploy ransomware. Victims are listed on a dedicated leak site where sample files or full archives are sometimes released. Public reporting has linked akira to numerous incidents worldwide; the group’s statements about any individual victim, including Thong Sia, remain claims rather than Reported Facts unless separately confirmed.

Who is Thong Sia?

Thong Sia Group is a member of the STELUX Group of Companies and operates as the sole distributor of Seiko watches, Seiko clocks, Lorus clocks, Alba watches, Wired watches and Seiko special time equipment in Hong Kong, Malaysia, Brunei, Singapore and Macau. As a regional distributor of consumer timepieces and related equipment, the company maintains commercial relationships with retailers, suppliers and end customers across those markets. Organisations of this type routinely hold financial records, employee personnel files, customer contact details and contractual documentation. A breach involving such an entity therefore carries potential consequences for both the business itself and the individuals whose data it processes.

What data was at risk

Public reporting states only that internal files were exfiltrated. In its leak-site listing, akira claims the material includes financial data such as audits, payment details and reports; passports and other employee and customer documents; and contact numbers and e-mail addresses of employees and customers. These categories are presented solely as the group’s assertions. The exact contents, volume and sensitivity of any files that may have been taken remain unconfirmed by independent sources. Organisations operating as brand distributors typically store accounting records, staff identity documents, customer order histories and correspondence; whether any of those specific categories were present in the exfiltrated set cannot be established from the available facts.

The real-world impact

If the claimed documents were indeed taken, employees and customers could face risks of identity misuse, targeted phishing or unsolicited contact. Financial records, if authentic and complete, might expose payment arrangements or commercial terms that competitors or fraudsters could exploit. For Thong Sia itself, the incident raises the possibility of operational disruption, regulatory scrutiny in the jurisdictions where it operates, and reputational damage among retail partners and consumers. Because the number of affected individuals is unknown and the precise data set is unverified, the scale of these risks cannot yet be quantified. Affected parties would need to monitor for unusual account activity and treat any unexpected communications with caution.

Were you affected?

If you are an employee, customer or business partner of Thong Sia or its related brands in the listed markets, consider reviewing recent account statements, enabling multi-factor authentication where available, and remaining alert to phishing messages that reference the company or its products. You can also run a free exposure scan of your email address to check whether it has already appeared in known breach data sets. Official notifications, if any are issued by the company or regulators, should be treated as the authoritative source of guidance.

AICompiled with AI assistance from public sources and published under our editorial standards.