Cascade Pacific Pulp listed on Akira ransomware leak site

• Ransomware group: Akira
• Country: United States
• Sector: Manufacturing
• Announcement date: September 30, 2025

Cascade Pacific Pulp targeted by Akira ransomware group

Cascade Pacific Pulp has been listed on the leak site of the Akira ransomware group. The threat actor group has announced that it has allegedly leaked 146 GB of data belonging to the organization. According to the claims made by the group, the incident and the discovery of the breach occurred on September 30, 2025.

Alleged data exfiltration by Akira

The Akira ransomware group has claimed to have exfiltrated various corporate and personal records during their operation. The group's announcement suggests that the stolen information includes a wide range of sensitive documentation. While the group has made these claims, no screenshots have been provided to verify the contents of the alleged leak.

The data allegedly involved in this incident includes several categories of highly sensitive information. According to the group's claims, the following types of data are included in the breach:

• Financial data (audits, payment details, invoices)
• Employee information
• Customer information
• Passport details
• Driver's licenses
• Social Security Numbers
• Contact information

The presence of such diverse data types, ranging from corporate financial audits to personal identification documents like passports and Social Security Numbers, indicates a broad scope of the alleged intrusion.

About Cascade Pacific Pulp

Cascade Pacific Pulp is a pulp mill located in the Pacific Northwest of the US, known for its environmentally progressive practices. The company produces 200,000 tons per year of high-grade pulp used in the manufacturing of tissue and printing papers.

Analysis and potential impact

This incident may pose secondary risks such as identity theft and targeted phishing attacks for the employees and customers of the organization. Given the sensitivity of the alleged data, it could trigger data breach notification requirements under various US state laws and federal regulations. The double-extortion method employed by the Akira group may damage the organization's commercial reputation and create negative impacts on the supply chain upon the publication of the data.

The group's tendency to exploit VPN vulnerabilities suggests that the organization's network security processes may need to be reviewed. Ransomware groups often utilize double-extortion tactics, where they not only encrypt an organization's systems but also steal sensitive data to use as leverage during negotiations. By threatening to release this data publicly, attackers aim to increase the pressure on the victim to pay the ransom.

For organizations operating in the manufacturing sector, such incidents highlight the importance of robust network security and access controls. Securing remote access points, such as Virtual Private Networks (VPNs), is a critical defensive step to prevent unauthorized entry. Furthermore, implementing strict data governance and encryption protocols can help mitigate the impact of a potential breach. Information about the Akira group remains limited, which is a common challenge for investigators dealing with evolving ransomware threats.