Gunnar Prefab listed on Akira ransomware leak site

• Ransomware group: Akira
• Country: Sweden
• Sector: Manufacturing
• Announcement date: January 6, 2025

Akira ransomware group claims breach of Gunnar Prefab

The Akira ransomware group has listed the Swedish manufacturing company Gunnar Prefab on its dedicated leak site. According to the announcement made on January 6, 2025, the threat actors claim to have gained unauthorized access to the organization's systems, leading to a significant data leak. The group alleges that the breach occurred around November 29, 2024.

In line with modern cyber extortion tactics, the threat actors have provided a specific method for accessing the allegedly stolen information. The group shared a torrent-based method for downloading the data and provided a password required to unlock the archive files. This method is commonly used by ransomware groups to distribute large volumes of data while making tracking more difficult for security researchers and law enforcement.

Details of the alleged data leak

The announcement from the Akira group claims that various documents related to the operational processes of the company have been compromised. While the group has not provided any screenshots to verify the contents of the files, they have specified the types of information they claim to possess. The leaked data is said to include sensitive corporate and personal information that could impact multiple stakeholders.

The specific data types mentioned in the leak include:

• Non-disclosure agreements
• Employee contact information
• Customer contact information
• HR documents

The presence of such documentation suggests a broad compromise of the company's internal administrative and operational files. It is important to note that no information was provided regarding the total size of the data or the specific number of files contained within the archives.

About Gunnar Prefab

Gunnar Prefab is a Swedish company that operates within the manufacturing sector. The organization specializes in the development, manufacture, and delivery of prefabricated concrete products. Their commercial activities and supply chain reach primarily cover the Nordic region, making them a key player in regional construction material production.

Potential impact and security implications

The nature of the data allegedly stolen by the Akira group carries significant risks for both the organization and the individuals involved. For the employees and customers of Gunnar Prefab, the exposure of contact information and HR documents creates a heightened risk of identity theft and targeted phishing attacks. Such attacks often leverage stolen personal details to gain trust and manipulate victims into revealing further sensitive information or transferring funds.

From a regulatory and business perspective, this incident presents several challenges. The alleged leak of personal data suggests that the organization could face administrative sanctions under the General Data Protection Regulation (GDPR). Furthermore, because the Akira group utilizes a double-extortion method—whereby they threaten to release data if a ransom is not paid—the company faces risks to its operational continuity and its commercial reputation.

There is also the potential for this breach to serve as a stepping stone for broader supply chain attacks. When a manufacturer's data is compromised, the attackers may use the information to target the company's partners or clients. In such scenarios, organizations typically focus on strengthening their defensive postures through rigorous patch management, multi-factor authentication, and continuous monitoring of network traffic to detect unauthorized access before data exfiltration can occur.

Publicly available information regarding the specific tactics and technical details of the Akira group remains limited, which is a common characteristic of many ransomware operations that prioritize anonymity.