CoMo-Industrial Engineering targeted by Akira ransomware group

• Ransomware group: Akira
• Country: Germany
• Sector: Manufacturing
• Announcement date: February 13, 2025

Akira ransomware group claims data breach at CoMo-Industrial Engineering

The Akira ransomware group has listed CoMo-Industrial Engineering on its leak site, claiming to have exfiltrated a significant amount of corporate data. According to the announcement made on February 13, 2025, the threat actor group alleges that they have obtained approximately 17 GB of data belonging to the organization. This claim follows an alleged intrusion into the company's network that reportedly occurred on February 4, 2025.

The Akira group is known for utilizing double-extortion tactics, a method where attackers not only encrypt an organization's systems to disrupt operations but also steal sensitive information to use as leverage. By threatening to leak stolen data on public forums or leak sites, these actors attempt to pressure victims into paying ransoms to prevent the disclosure of confidential information. Information regarding the specific technical capabilities and background of this group remains limited.

Details of the alleged data theft

The threat actor's announcement suggests that the stolen information is comprised of various corporate documents. While no screenshots were provided to verify the contents of the data, the group claims to possess a variety of sensitive files obtained from the organization's network. The volume of data involved is estimated at 17 GB.

The information allegedly compromised includes the following categories:

• Financial data
• Employee contact information
• Customer contact information

The presence of such data in a leak listing indicates a significant breach of confidentiality. In many ransomware incidents, the theft of such information is a primary objective, as it provides the attackers with high-value assets that can be used for further exploitation or extortion.

About CoMo-Industrial Engineering

CoMo-Industrial Engineering is a firm based in Germany that specializes in providing engineering services for industrial facilities. The company's technical expertise includes piping design, flexibility analysis, and performing strength calculations for pressure vessels and storage tanks. Given the nature of their work, the organization is deeply integrated into industrial infrastructure and engineering processes.

Potential impact and security considerations

This incident may pose significant risks to the organization's operational processes and overall data privacy. The leaked financial data and personal information could potentially facilitate identity theft or targeted phishing attacks against the affected parties. Because the organization is based in Germany, this breach may result in legal sanctions and administrative processes under the General Data Protection Regulation (GDPR).

Furthermore, considering the double-extortion tactics employed by the Akira group, secondary risks for the organization's supply chain partners may also be observed. When an engineering firm is compromised, the data involved may have implications for the clients and partners who rely on their technical specifications and project details.

In such scenarios, it is often considered important for organizations to review their data security protocols and notify the affected parties. Defensive strategies typically include implementing robust access controls, maintaining offline backups, and conducting regular security audits to identify vulnerabilities before they can be exploited by threat actors. Monitoring for unusual network traffic and ensuring that all software is patched are also standard practices to mitigate the risk of unauthorized access.