Akira ransomware group claims data breach against Bugnard

• Ransomware group: Akira
• Country: Switzerland
• Sector: Technology
• Announcement date: September 30, 2025

Akira ransomware group claims data breach against Bugnard

The Akira ransomware group has announced a significant data leak involving the Swiss technology company Bugnard. According to an announcement made on a ransomware leak site on September 30, 2025, the threat actors claim to have exfiltrated a substantial amount of data belonging to the organization. The group alleges that the breach occurred on September 29, 2025, and they have listed the company on their platform as part of their extortion process.

Details of the alleged attack

The Akira group claims to have successfully obtained data from Bugnard and has publicly listed the company on its dedicated leak site. This type of announcement is a common tactic used by modern ransomware collectives to pressure victims into meeting ransom demands. The threat actor has stated that the incident took place on September 29, 2025, and has expressed an intention to publish the acquired data on their platform.

While the group has not provided a screenshot to verify the contents of the stolen data, they have made specific claims regarding the nature of the information they have allegedly acquired. The group alleges that the compromised files include a variety of sensitive corporate and personal records, which could pose a significant risk to the organization and its stakeholders if released.

Alleged compromised data types

The threat actor claims that the following types of information are included in the leak:

• Financial documents
• Agreements
• Confidential files
• Project data
• Client information

About Bugnard

Bugnard is a Swiss market leader in the supply of equipment used for the installation of electrical and telecommunication networks. The company provides technical hardware and solutions for infrastructure projects, serving as a key provider within the technology sector in Switzerland.

Impact and security implications

This alleged data breach may lead to a compromise of confidentiality regarding Bugnard's corporate data. The exposure of client information and financial records could increase the risk of identity theft or targeted phishing attacks against the affected individuals. Given that the entity is based in Switzerland, the incident may result in legal consequences under the Federal Act on Data Protection (FADP) and the General Data Protection Regulation (GDPR).

Considering the Akira group's double-extortion tactics, the publication of this data could lead to significant reputational damage and the disclosure of trade secrets. Double extortion is a method where attackers not only encrypt an organization's systems but also steal sensitive data, threatening to leak it publicly unless a ransom is paid. This approach places immense pressure on companies due to the potential for regulatory fines and loss of client trust.

Information about the Akira group is limited; however, it is known that they frequently exploit VPN vulnerabilities in similar attacks. Organizations in the technology and infrastructure sectors often face such threats due to the high value of their project details and client information. To defend against such risks, organizations typically implement robust security measures, such as multi-factor authentication, regular security audits, and strict access controls for virtual private networks to mitigate the risk of unauthorized entry.