Coe Press Equipment listed on Akira ransomware leak site

• Ransomware group: Akira
• Country: United States
• Sector: Manufacturing
• Announcement date: September 22, 2026

Coe Press Equipment targeted by Akira ransomware group

The Akira ransomware group has listed the American manufacturing firm Coe Press Equipment on its dedicated leak site. According to the announcement made on September 22, 2026, the threat actors claim to have successfully exfiltrated 25 GB of data belonging to the organization. This development marks a significant escalation in the group's targeting of industrial entities.

Details of the alleged attack

The Akira ransomware group announced that they obtained data belonging to Coe Press Equipment on September 22, 2026. The group has indicated their intention to publish the company's corporate data on their leak site. While public information regarding this specific group remains limited, they are known to employ double-extortion tactics during their campaigns. In such scenarios, attackers do not merely encrypt a victim's systems but also steal sensitive information to use as leverage, threatening to release it publicly if a ransom is not paid.

Furthermore, the group is known to often gain initial access to victim networks through the exploitation of VPN accounts. This method allows attackers to bypass traditional perimeter defenses by leveraging legitimate, yet compromised, remote access credentials to move laterally through a corporate network.

Claimed data types and contents

The leak allegedly contains a wide range of sensitive information. While no screenshot has been provided to verify the contents, the group claims the stolen data includes:

• Employee personal data (including SSNs, driver's licenses, and passports)
• HR files
• Financial records
• Projects
• Confidential client documents
• Non-disclosure agreements (NDAs)

About Coe Press Equipment

Coe Press Equipment is an American company that designs and manufactures coil handling and servo roll feed equipment. The company provides various industrial metalworking solutions, ranging from stand-alone feeders to fully integrated lines.

Risk assessment and implications

The nature of the allegedly exfiltrated data may increase the risk of identity theft and fraud for the company's employees and clients. Given the company's location in the United States, legal processes under state-level data breach notification laws and relevant regulations may be triggered as a result of this incident.

The publication of this data could lead to the compromise of the company's trade secrets and intellectual property rights. Furthermore, such leaks may pose secondary risks to other stakeholders within the company's supply chain, potentially impacting the security and operational integrity of business partners.

The group's use of double-extortion tactics may exacerbate the potential reputational damage to the organization if the data is released. For organizations operating in the manufacturing sector, such breaches highlight the importance of robust security measures. Common defensive steps for organizations include implementing multi-factor authentication (MFA) on all remote access points, such as VPNs, to mitigate the risk of credential exploitation. Additionally, maintaining strict network segmentation and conducting regular audits of access logs can help detect unauthorized lateral movement within the network before significant data exfiltration occurs.