Bihl targeted by Akira ransomware group in alleged data breach

• Ransomware group: Akira
• Country: Germany
• Announcement date: August 24, 2026

The Akira ransomware group has listed the German organization Bihl on its dedicated leak site, claiming to have successfully exfiltrated a significant volume of corporate data. According to the announcement made on August 24, 2026, the threat actors claim to be in possession of 392 GB of information belonging to the company.

The details of the claim

The threat actor responsible for the Akira ransomware group has created a formal leak announcement specifically targeting Bihl. Through this post, the group asserts that they have gained unauthorized access to the organization's internal systems and have successfully exfiltrated corporate data. The announcement specifies that the total volume of the claimed data amounts to 392 GB.

The group has indicated their intention to publish the stolen information in the near future. While the announcement serves as a method of pressure, no screenshots of the stolen data were provided by the attackers to verify the legitimacy of the claim at the time of the posting. This type of tactic is common among modern ransomware operations, where the threat of imminent publication is used to coerce the victim into meeting specific demands.

The alleged stolen data

The contents of the alleged leak are reported to be highly sensitive, encompassing a wide range of personal and corporate information. The data claimed to be in the possession of the Akira group includes a variety of identity documents and private contact details. Specifically, the following types of information are said to be included in the breach:

• Employee passports
• Driver's licenses
• Addresses
• Social security numbers
• Birth and death certificates
• Phone numbers
• Financial documents
• Contracts
• Non-disclosure agreements
• Client information

The inclusion of such diverse data types suggests a comprehensive breach of both employee and corporate records. The presence of highly personal identifiers, such as social security numbers and birth certificates, alongside sensitive business documents like contracts and non-disclosure agreements, indicates a high level of sensitivity regarding the alleged exfiltrated content.

About Bihl

Bihl, also known as Boustead International Heaters (BIH), is a global engineering company. The organization specializes in the design and supply of thermal process equipment. Their product portfolio includes critical components such as direct-fired heaters, waste heat recovery units, and heat recovery steam generators. Bihl provides essential heat transfer solutions specifically tailored for the energy and petrochemical industries.

Analysis and implications

The Akira group is known for employing double-extortion tactics, a method where attackers not only encrypt an organization's data but also threaten to leak sensitive information to force payment. The publication of the data claimed in this incident may significantly increase the risk of identity theft for both the employees and the clients of Bihl. Because the organization is based in Germany, this incident may trigger specific legal obligations, such as data breach notification requirements and potential administrative sanctions under the General Data Protection Regulation (GDPR).

Furthermore, the sensitivity of the alleged data could facilitate targeted phishing attacks against the organization's various supply chain partners. When attackers possess detailed contact information and contract details, they can craft highly convincing social engineering campaigns. Given the group's known tendency to exploit vulnerabilities in Virtual Private Networks (VPNs), it is possible that weaknesses in the organization's network security processes may have been leveraged during this incident.

For organizations operating in critical industrial sectors, such incidents highlight the necessity of robust defensive measures. Common defensive steps include maintaining rigorous patch management for all external-facing services, implementing multi-factor authentication (MFA) across all access points, and conducting regular security audits of network configurations. Additionally, monitoring for unusual data exfiltration patterns and ensuring comprehensive encryption for data at rest and in transit can help mitigate the impact of such breaches.