Ferretti Construction listed on Akira ransomware leak site

• Ransomware group: Akira
• Country: Italy
• Sector: Manufacturing
• Announcement date: February 2, 2026

Akira ransomware group targets Ferretti Construction

The Akira ransomware group has listed data allegedly belonging to Ferretti Construction on its leak site. According to the announcement, the group claims to have obtained a significant amount of corporate information, potentially impacting the Italian engineering and construction firm.

Details of the alleged attack

The Akira group published a leak announcement regarding Ferretti Construction on February 2, 2026. The group claims to have obtained 66 GB of corporate data. It is stated that the attack occurred on January 16, 2026, and the group suggests that the data will be released in the near future. No screenshot was provided to verify the contents of the leak.

Data types involved in the claim

According to the announcement, the leaked data is said to include a variety of sensitive documents. The specific items mentioned in the claim include:

• Employee passports
• Driver's licenses
• Financial records
• Confidentiality agreements
• Contracts
• Various project files

No information was provided regarding a specific ransom demand or the total number of files involved in the breach.

About Ferretti Construction

Ferretti Construction is an Italian engineering and construction company with a 100-year history in the field of industrial construction. They provide a wide range of services from basic and detailed engineering to construction, as well as project and construction management.

Analysis and potential impact

This alleged data breach may pose a risk of identity theft due to the exposure of employees' personal information, such as passports and driver's licenses. The disclosure of corporate financial records and project files could potentially impact the company's business operations and competitive standing. As the institution is based in Italy, it is likely that the incident could be evaluated as a data protection breach under GDPR, potentially triggering legal consequences.

Given the Akira group's double-extortion tactics, the publication of this data may be intended to exert pressure on the organization. Double extortion is a common ransomware tactic where attackers not only encrypt a victim's data but also steal sensitive information, threatening to leak it publicly if a ransom is not paid. This method increases the pressure on organizations by threatening their reputation and legal standing.

Furthermore, the leaked information could potentially be utilized for secondary attacks or targeted phishing campaigns. When sensitive corporate and personal data is exposed, it often serves as a foundation for subsequent social engineering efforts aimed at employees or business partners. Organizations in the manufacturing and construction sectors can take various defensive steps to mitigate such risks, such as implementing robust access controls, maintaining regular offline backups, and conducting comprehensive employee training on phishing awareness.