Amtech Software targeted by Monti ransomware group

• Ransomware group: Monti
• Country: United States
• Sector: Technology
• Announcement date: May 8, 2025

The ransomware group known as Monti has posted an announcement on its leak site claiming responsibility for a significant data breach involving Amtech Software. According to the group's claim, they successfully gained unauthorized access to the systems of the United States-based technology firm and exfiltrated a massive volume of data. The announcement, which appeared on May 8, 2025, suggests that the initial attack occurred on May 7, 2025.

The details of the alleged attack

The Monti group claims to have successfully infiltrated the network of Amtech Software, leading to the alleged theft of a substantial amount of information. The group asserts that the volume of data stolen ranges between 30 and 40 terabytes. This massive scale of exfiltration is a hallmark of modern ransomware tactics, often referred to as double extortion, where attackers not only encrypt a victim's systems but also steal sensitive data to use as leverage during ransom negotiations.

In such scenarios, threat actors typically threaten to publish the stolen information on public leak sites if their demands are not met. In this specific instance, the Monti group has declared its intention to publish the allegedly compromised data on October 15, 2025. It is important to note that public information regarding the specific methods, tools, or identity of the Monti group remains limited.

Data types allegedly compromised

The announcement made by the Monti group specifies that the breach involves several categories of sensitive information. The group claims that the stolen data includes critical internal records and intellectual property. According to the listing, the following types of data have been compromised:

• HR records
• Accounting records
• Software source code

The inclusion of software source code is particularly significant in the context of a technology provider, as it represents the core intellectual property of the organization. The presence of HR and accounting records suggests that the breach may also contain sensitive personal and financial information belonging to employees and business partners.

About Amtech Software

Amtech Software is a technology company based in the United States. The organization specializes in providing Enterprise Resource Planning (ERP) software solutions. These solutions are specifically designed and tailored for the corrugated and packaging industry, serving as a critical component in the operational workflows of its clients.

Potential impact and industry implications

The alleged exfiltration of 30-40 terabytes of data poses significant risks to the operational continuity and the established trust of Amtech Software. Because the company develops and provides ERP software, the potential leak of software source code and other data creates a high risk of secondary vulnerabilities. Specifically, such a breach could potentially lead to supply chain attacks, where attackers use the stolen information to target the systems of the company's customers.

Furthermore, the nature of the stolen data could facilitate various malicious activities. The exposure of HR and accounting records provides a foundation for identity theft and corporate espionage. For a US-based entity, such a breach may also trigger complex legal processes governed by various state laws and federal regulations regarding data protection and privacy.

In the broader context of the technology and software sector, organizations often face these types of threats. To mitigate such risks, industry experts generally recommend robust defensive measures. These include implementing strict access controls, maintaining comprehensive logging and monitoring to detect unauthorized movement, and ensuring regular, offline backups. Furthermore, securing the software development lifecycle (SDLC) is vital to prevent source code leaks from translating into downstream supply chain compromises for the entire customer base.