Friis & Moltke data allegedly leaked by Akira ransomware group

• Ransomware group: Akira
• Country: Denmark
• Sector: Manufacturing
• Announcement date: December 22, 2025

Akira ransomware group claims data breach at Friis & Moltke

The Akira ransomware group has officially listed the Danish architectural firm Friis & Moltke on its leak site. According to the announcement, the group claims to have successfully exfiltrated a significant amount of data belonging to the organization. This development follows the group's established pattern of targeting various sectors and utilizing public leak sites to pressure victims through the threat of data exposure.

The announcement regarding the alleged breach was published on December 22, 2025. While the group has made these claims publicly, it is important to note that the information is based on the group's own assertions. The incident highlights the ongoing threat posed by ransomware groups that utilize public platforms to announce their successful attacks and claim responsibility for the theft of sensitive information.

Details of the alleged data exfiltration

The Akira ransomware group claims to have obtained a substantial volume of information, specifically stating that the leaked data consists of 12 GB. The group alleges that this stolen data includes a wide range of sensitive materials, spanning from corporate-level information to highly personal documentation. According to the group's claims, the stolen files encompass corporate data, project files, and various personal documents.

The specific types of data mentioned in the group's claim include:

• Personal identification documents
• Danish social security numbers (CPR)
• Financial records
• Corporate projects and drawings

While the group has provided a detailed list of the types of information they claim to possess, they have not provided any screenshots to verify the contents of the stolen data. No information was provided regarding a specific ransom demand in the announcement.

About Friis & Moltke

Friis & Moltke is a well-established architectural firm based in Denmark. The company provides professional architectural design and planning services, playing a role in the development of various spaces. Their work involves creating architectural solutions for a diverse array of projects, which includes residential, commercial, and public spaces.

Potential impact and security implications

The claims made by the Akira group suggest significant risks for both the institution and the individuals involved. If the allegations are accurate, the exposure of personal identification documents and Danish social security numbers (CPR) could place employees and clients of the firm at a heightened risk of identity theft. Such sensitive information is highly valuable to malicious actors for fraudulent activities.

Furthermore, the nature of the firm's work in the architecture sector implies that the exposure of corporate projects and drawings could lead to substantial commercial losses, particularly if the leaked files contain valuable intellectual property. The exposure of technical specifications and financial records can also undermine the commercial standing of the organization.

Given that the organization operates within Denmark, these claims may trigger legal obligations regarding data breach notifications under the General Data Protection Regulation (GDPR). The Akira group is known for employing a double extortion method, where they not only encrypt an organization's systems but also threaten to leak stolen data to maximize their leverage. This method increases the risk that stolen data could be used for secondary attacks, such as targeted phishing campaigns against the organization's partners or clients.

In general, organizations facing such threats are encouraged to implement robust defensive measures. These typically include maintaining offline backups, implementing multi-factor authentication, and conducting regular security awareness training to defend against phishing. For companies in the architecture and design sector, protecting intellectual property and technical drawings is a critical component of a comprehensive cybersecurity strategy to prevent commercial and reputational damage.