Donlar Construction listed on Akira ransomware leak site

• Ransomware group: akira
• Country: United States
• Sector: Manufacturing
• Announcement date: July 24, 2025

Donlar Construction targeted by Akira ransomware group

Donlar Construction has been listed on the leak site of the Akira ransomware group. The threat actors claim to have exfiltrated approximately 50 GB of data from the organization. This announcement, made on July 24, 2025, follows an alleged attack that occurred on June 25, 2025.

Details of the alleged data exfiltration

The Akira ransomware group, a Ransomware-as-a-Service (RaaS) entity known for employing double-extortion tactics, claims to have obtained a significant volume of corporate information. Double-extortion is a common ransomware tactic where attackers not only encrypt an organization's data but also steal it, threatening to leak the sensitive information on a public leak site if a ransom is not paid. This method increases the pressure on the victim by threatening reputational damage and legal consequences.

According to the group's announcement, the stolen data is quite diverse and includes various types of sensitive information. While no screenshots were provided to verify the contents of the leak, the group claims the following data types were compromised:

• Employee personal information
• Medical information
• Financial data
• Project data
• Non-disclosure agreements

The group has been active since early 2023, and while public information regarding their specific operations remains limited, they are recognized for their ability to target various sectors.

About Donlar Construction

Donlar Construction is a full-service construction firm. The company provides general contracting and construction management services, operating primarily in Minnesota and the Upper Midwest region.

Risk assessment and security implications

The nature of the data allegedly stolen poses significant risks to the individuals involved. Because the claim includes employee personal information and medical information, those individuals may be at risk of identity theft and targeted phishing attacks. Such attacks often leverage stolen personal details to gain trust or bypass security measures in subsequent fraudulent activities.

From a corporate standpoint, the organization may face legal obligations under US state-level data protection laws and relevant sectoral regulations due to the sensitive nature of the leaked information. Furthermore, the leak of project and financial data introduces secondary risks, such as potential supply chain attacks or a loss of commercial reputation.

The Akira group has shown a tendency to exploit VPN vulnerabilities to gain access to networks. This specific behavior suggests that organizations in similar sectors may need to implement significant improvements in their network security processes, particularly regarding remote access protocols. To defend against such threats, organizations typically focus on strengthening authentication, monitoring for unauthorized access, and ensuring robust patch management for all perimeter devices.