TrussWorks International Listed by akira Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

People whose personal or financial details may sit inside TrussWorks International’s systems now face a concrete risk: a ransomware group has publicly claimed to hold a large cache of the company’s internal files and is threatening to release them. Because the number of individuals affected remains unknown and the exact contents of the files have not been independently verified, anyone who has worked with or for the firm should treat the possibility of exposure as real until more information emerges.

On 18 April 2025 the group known as akira listed TrussWorks International on its leak site, stating that more than 13 GB of corporate documents had been taken. The listing itself is a claim, not a confirmed forensic finding, yet it is the only public signal that a breach has occurred. For employees, customers and partners, the practical stakes are identity theft, financial fraud and the misuse of sensitive business information.

What happened

Public reporting on 18 April 2025 stated that TrussWorks International had been listed by the akira ransomware group. According to the group’s own leak-site entry, internal files were exfiltrated during a ransomware attack and the operators were prepared to publish more than 13 GB of material. No independent confirmation of the intrusion method, the precise date of the attack, or the total volume of data has been released by the company or by law-enforcement agencies. The number of people whose records may be involved is listed as unknown. Beyond the group’s assertion that the files contain contact details, government identifiers and financial records, no further technical details about the incident have been disclosed.

Who is akira?

Akira is a ransomware operation that became publicly active in early 2023. Like many contemporary groups, it follows a double-extortion model: systems are encrypted and a copy of the data is stolen so that the operators can threaten to publish the material if a ransom is not paid. The group typically gains initial access through compromised credentials or unpatched remote-access services, then moves laterally, exfiltrates data and deploys encryption. Its leak site has previously named organisations across manufacturing, professional services and other sectors. Claims posted on that site are statements by the attackers themselves; they are not independent verification that a breach occurred or that every file listed is authentic. In this case, the listing of TrussWorks International should be read as an unverified claim by the group.

About TrussWorks International

TrussWorks International describes itself as a firm that can engineer, design, fabricate, machine, paint and pre-assemble all aspects of a project in-house, giving it control over quality, schedule and budget. Organisations of this type typically maintain detailed records of employees, suppliers and clients, together with engineering drawings, contracts, financial audits and non-disclosure agreements. Because the company sits at the intersection of manufacturing and project management, a compromise of its systems can expose both personal identifiers and commercially sensitive technical and financial information. The potential reach of any breach therefore extends beyond the firm’s own staff to the customers and partners whose data it holds.

What data was at risk

The only description of the data comes from the akira group’s own statement. The operators claim they are ready to upload more than 13 GB of essential corporate documents that include contact numbers and e-mail addresses of employees and customers, Social Security numbers, phone numbers, addresses, driver’s licences, financial data such as audits, payment details and reports, and corporate non-disclosure agreements. These categories have not been independently confirmed. Public detail on the precise contents of the exfiltrated files remains limited; the number of individuals whose records appear in the cache is unknown. Organisations that perform engineering and fabrication work commonly hold exactly the kinds of personal and financial records the group lists, but until verified samples or official disclosures appear, the exact scope of exposure cannot be stated as fact.

What's at stake

For individuals, the practical risks include identity theft, fraudulent account openings, targeted phishing and the misuse of government-issued identifiers. Financial records and payment details can be used for invoice fraud or unauthorised transactions. For the organisation itself, the release of client lists, contracts and non-disclosure agreements can damage commercial relationships, expose proprietary project information and create regulatory or contractual liabilities. Because the volume of data claimed is substantial and the number of affected people is unknown, the window of uncertainty itself becomes a source of risk: people cannot take protective steps if they do not know whether their information is among the files.

What to do if you're exposed

Anyone who has been an employee, customer or partner of TrussWorks International should monitor bank and credit accounts for unusual activity, place fraud alerts with the major credit bureaux if they are in a jurisdiction that offers them, and treat unsolicited requests for personal or financial information with heightened caution. Changing passwords on accounts that may have used the same credentials, and enabling multi-factor authentication where available, reduces the chance of further compromise. Readers can also run a free exposure scan of their email address to check whether their information has already surfaced in known breach data sets; doing so provides an early indication of whether their details appear in publicly circulating collections.

AICompiled with AI assistance from public sources and published under our editorial standards.