Akira ransomware group claims data breach at MSM International (TOYOMI)

• Ransomware group: Akira
• Country: Malaysia
• Sector: Manufacturing
• Announcement date: May 20, 2025

Akira ransomware group claims data breach at MSM International (TOYOMI)

The Akira ransomware group has listed MSM International (TOYOMI) on its dedicated leak site, alleging a significant data breach. According to the claims made by the threat actors, the incident occurred on May 20, 2025. The group asserts that they have successfully compromised and exfiltrated a substantial amount of corporate information belonging to the organization.

Details of the alleged incident

The Akira ransomware group claims that the breach involves over 6 GB of corporate data. While the group has announced the victim on their leak site, it is important to note that no screenshots have been provided to verify the contents of the shared data. Consequently, the authenticity of the leaked information remains unverified at this time.

The group alleges that the stolen information includes several sensitive categories of data. According to their claims, the exfiltrated files consist of:

• Employee personal documents
• Accounting files
• Project files

The specific details regarding the exact nature of the accounting files, such as whether they pertain to partners or internal operations, are described by the group as detailed accounting files of partners.

About MSM International (TOYOMI)

MSM International (TOYOMI) is a company established in 1992. It operates as the marketing unit of MSM Metal Industries Sdn Bhd. The organization provides sheet metal forming services to the manufacturing and engineering sectors within Malaysia and on an international scale.

Analysis and potential implications

This incident may pose secondary risks such as identity theft or targeted phishing attacks for the organization's employees and business partners. The alleged leak of accounting and project files could lead to the exposure of trade secrets and potential damage to the organization's competitive advantage. Given the Akira group's double-extortion method, the publication of data may be intended to exert pressure on the organization.

Double extortion is a common tactic used by modern ransomware groups. In this method, attackers do not just encrypt a victim's systems to disrupt operations; they also steal sensitive data before the encryption process begins. The threat actors then threaten to leak this data on public forums or leak sites if a ransom is not paid. This adds a layer of pressure, as the victim faces the risk of regulatory fines, reputational damage, and the loss of intellectual property even if they can restore their systems from backups.

The Akira group has been known to be active since early 2023. They frequently gain access to target systems by exploiting vulnerabilities in Virtual Private Networks (VPNs). This specific pattern of attack suggests that the organization's cybersecurity infrastructure may require a thorough review to identify and remediate potential entry points.

For organizations operating in the manufacturing and engineering sectors, such incidents highlight the importance of robust defensive measures. Implementing multi-factor authentication (MFA) on all remote access points, such as VPNs, is a critical step in preventing unauthorized access. Furthermore, maintaining strict network segmentation can help prevent attackers from moving laterally through a network to access sensitive project or accounting files. Regular vulnerability scanning and timely patching of edge devices are also essential components of a proactive cybersecurity posture to mitigate the risks posed by known exploits used by groups like Akira.