Van Eycken Listed by akira Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On January 22, 2026, the ransomware group akira listed Van Eycken on its data-leak site. The entry states that internal files were taken during a ransomware incident and that the group intends to publish 69 gigabytes of material. The number of people whose information may be involved is not reported. The listing remains an unverified claim by the group. No independent confirmation of the volume, contents, or circumstances of any exfiltration has been made public.

Breaking down the breach

The incident came to light solely through the akira leak-site listing dated January 22, 2026. The group asserts that corporate data was removed and will be released unless its demands are met. No details have been disclosed about when the intrusion began, how long the attackers had access, or the technical method used to obtain the files. The scale of any encryption of live systems is also unreported.

Public information stops at the group’s statement that 69 gigabytes of material will be uploaded. No victim statement, regulatory filing, or law-enforcement notice has added further Reported Facts at this stage.

The group behind it: akira

Akira is a ransomware operation that first appeared in early 2023. It is known for a double-extortion approach: encrypting victim systems while also copying data and threatening public release if payment is not received. The group maintains a Tor-based leak site where it lists organizations and, in some cases, posts sample files or full archives.

Public reporting has linked akira to intrusions across multiple countries and industries. Its operators have used commodity and custom tools to gain initial access, move laterally, and exfiltrate data before deploying encryption. Like other ransomware groups, akira’s listings represent its own assertions rather than independently verified events.

Van Eycken and its sector

Van Eycken works in metal fabrication and civil-engineering components. Its stated activities include the design and installation of railings, structural steelwork, bridges, vehicle barriers, sound barriers, and related assembly and metalworking services. Organizations in this sector routinely manage project documentation, supplier contracts, engineering drawings, and personnel records tied to on-site work.

Because such firms often support public infrastructure and transport projects, any prolonged exposure of internal records can affect operational continuity and relationships with clients and subcontractors. The sector’s reliance on detailed project files and regulatory compliance documents makes the handling of those records a routine part of daily business.

The information in question

The akira listing claims the exfiltrated material includes detailed employee personal information such as passports and scans of other documents, HR files, financial records, project files, and confidentiality agreements. The group states it will upload 69 gigabytes of this corporate data.

Independent confirmation of the exact categories or the presence of any specific document type has not been provided. Organizations of this kind commonly store employee identification records, payroll information, contract details, and engineering specifications, but whether those categories are present in the claimed archive remains unverified.

What's at stake

Individuals named in any exposed HR or identity documents face the possibility of their personal details circulating. This can lead to targeted phishing, attempts to open accounts in their names, or misuse of scanned identity papers. The practical impact depends on which records, if any, are eventually published and how quickly they are removed from circulation.

For the organization, release of project files and financial information could reveal commercial terms, design specifications, or internal processes to competitors or other parties. Any confirmed data loss may also trigger notification obligations under applicable data-protection rules, though the scope of those obligations cannot be assessed until more facts are established.

What to do if you're exposed

Anyone who believes their information may be involved should monitor their financial accounts and official correspondence for unusual activity. Placing fraud alerts with credit agencies and reviewing tax filings for unexpected submissions are standard first steps when identity documents are at risk.

Changing passwords for any work-related or personal accounts and enabling multi-factor authentication where available can limit further misuse. Individuals can also run a free exposure scan of their email address against known breach data sets to check whether their information has appeared in previously published collections.

AICompiled with AI assistance from public sources and published under our editorial standards.