Akira ransomware group claims data leak against Toppan Next

• Ransomware group: Akira
• Country: Japan
• Sector: Technology
• Announcement date: April 18, 2025

Akira ransomware group claims data leak against Toppan Next

The Akira ransomware group has published a claim on its leak site involving a data breach against the technology company Toppan Next. According to the announcement, the group has listed a significant amount of data that they claim belongs to the organization.

Details of the alleged attack

The Akira ransomware group has listed over 12 GB of data on their leak site, which they claim belongs to Toppan Next. The group alleges that they obtained access to this data by exploiting vulnerabilities in the organization's digital and physical information security processes. The announcement was published on April 18, 2025, and the group has stated that the data is currently ready for release.

Ransomware groups often utilize leak sites to pressure victims through a tactic known as double extortion. In these scenarios, attackers do not just encrypt an organization's systems to disrupt operations; they also steal sensitive information to threaten its public release. This creates a dual pressure point: the victim must deal with the operational downtime caused by encryption and the reputational and legal risks associated with the exposure of private data.

Alleged data types involved in the breach

According to the information provided in the post, the allegedly leaked data includes a variety of sensitive information. While no screenshot has been provided to verify the contents of the leak, the group claims the following data types are involved:

• Employee personal data
• Customer data
• Financial data
• Payment details
• Credit card information
• Contracts
• Non-disclosure agreements

The exposure of such diverse datasets, ranging from personal identifiers to financial and legal documents, represents a significant security event for the targeted organization.

About Toppan Next

Toppan Next is a technology company operating as part of the global printing and technology giant Toppan Holdings. The company provides digital security, data management, and corporate information protection solutions. Its services are designed to help businesses safeguard both their digital and physical assets.

Potential impact and security considerations

This incident may increase the risk of identity theft or targeted phishing attacks against Toppan Next employees and customers. The exposure of financial data and credit card details could potentially lead to long-term economic losses for the organization's clients. Given the Akira group's use of double-extortion tactics, the publication of this data may create negative impacts on the organization's commercial reputation and legal compliance processes.

Under Japan's data protection regulations, the organization may face notification obligations, which could lead to administrative sanctions. Furthermore, as the group's past activities suggest that VPN vulnerabilities may be exploited, the organization's network security processes may need to be reviewed.

For organizations operating in the technology and data management sectors, such incidents highlight the necessity of robust network security. Common defensive steps for organizations include implementing multi-factor authentication, maintaining rigorous patch management schedules to address vulnerabilities, and conducting regular audits of both digital and physical security processes. Strengthening VPN security and monitoring for unauthorized access are also critical components of a modern defense-in-depth strategy to mitigate the risk of unauthorized data exfiltration.