Akira ransomware group lists Rommel's Ac\Rommel Electric\Rommel Harley - Davidson on its leak site

• Ransomware group: Akira
• Country: United States
• Sector: Manufacturing
• Announcement date: May 20, 2025

The Akira ransomware group has listed Rommel's Ace, Rommel Electric, and Rommel Harley-Davidson on its leak site. The threat actor group claims to have obtained approximately 2 GB of data belonging to these organizations, which they intend to publish.

The details of the alleged breach

On May 20, 2025, the Akira ransomware group announced that it had successfully targeted Rommel's Ace and its affiliated companies. According to the group's announcement on their leak site, they have acquired a significant volume of data, estimated to be around 2 GB, which they claim was taken directly from the company's internal systems.

It is important to note that the group has not provided any screenshots to verify the authenticity of the stolen information. Consequently, the specific contents and the validity of the breach are based solely on the claims made by the Akira group. The group has indicated their intention to release this data, a common tactic used in modern cyber extortion campaigns.

The scope of the claimed data leak

While no visual evidence has been provided by the attackers, the group has issued a statement detailing the types of sensitive information they claim to have exfiltrated. The alleged leak involves a wide range of highly sensitive personal and corporate information, which could pose significant risks to both employees and the business operations of the affected entities.

According to the group's claims, the stolen data includes the following items:

• Passport numbers
• Address information
• Personal email addresses
• Social Security Numbers (SSN)
• Medical records
• Accounting files
• Project files

Implications and potential risks

The Akira group is recognized for employing double-extortion tactics. In these scenarios, attackers do not just encrypt a victim's systems but also steal sensitive data, threatening to leak it publicly unless a ransom is paid. This method increases the pressure on organizations, as the threat of a data leak remains even if the company can restore its systems from backups.

The exposure of such sensitive personal data belonging to employees carries severe risks. Information such as Social Security Numbers, passport numbers, and medical records can be utilized by malicious actors for identity theft or to launch highly targeted phishing attacks against the individuals involved. Furthermore, the disclosure of internal accounting and project files could have a detrimental impact on the company's competitive position and its overall business operations.

Given that the target organization is based in the United States, this incident may lead to significant legal consequences. The exposure of medical records and personal identifiers could trigger investigations and penalties under HIPAA and various state-level data protection regulations. Additionally, considering the history of the Akira group, there is a possibility that the leaked data could be leveraged to facilitate secondary attacks against the organization or its partners.

To defend against such threats, organizations typically focus on securing remote access points, as this group is known for frequently targeting VPN vulnerabilities. Implementing robust multi-factor authentication, maintaining strict network segmentation, and ensuring comprehensive monitoring of data exfiltration patterns are common defensive measures used to mitigate the risk of ransomware and subsequent data leaks.