High Grade Materials targeted by Akira ransomware group

• Ransomware group: Akira
• Country: United States
• Sector: Manufacturing
• Announcement date: May 28, 2025

Akira ransomware group claims data breach at High Grade Materials

The Akira ransomware group has posted an announcement on its leak site claiming that it has successfully compromised the systems of High Grade Materials. According to the threat actor, the breach involves a significant amount of corporate information, which the group has threatened to release publicly.

Details of the claimed attack

The Akira group claims to have obtained approximately 20 GB of corporate data belonging to High Grade Materials. While the announcement was made on May 28, 2025, the group suggests that the initial attack on the institution's systems may have occurred as early as May 2, 2025. No ransom demand has been specified in the leak site announcement.

Ransomware groups often utilize a tactic known as double extortion. In this scenario, attackers do not just encrypt a victim's files to disrupt operations; they also exfiltrate sensitive data before the encryption process begins. This allows the threat actors to threaten the victim with the public release of their confidential information if the ransom is not paid, creating additional pressure on the organization.

Data involved in the leak

The leak announcement mentions that the stolen data includes various types of sensitive information. Although no screenshots were provided to verify the contents of the stolen files, the group claims to have access to the following categories of data:

• Employee personal data
• Financial data
• Contracts
• Official documents

The presence of such diverse data types indicates a broad compromise of the organization's internal documentation and administrative records.

About High Grade Materials

High Grade Materials is a Michigan-based company. The organization specializes in the production and supply of concrete and concrete-related products.

Risk assessment and organizational implications

This incident may increase the risk of identity theft for the institution's employees due to the exposure of their personal information. Furthermore, the leaked financial data and contracts could potentially be used for secondary attacks or targeted phishing campaigns against the institution's business operations. Such campaigns often leverage the specific details found in contracts to appear legitimate to employees or business partners.

As a US-based entity, legal proceedings under relevant state laws and data protection regulations may be triggered as a result of this exposure. The Akira group is known to operate as a Ransomware-as-a-Service (RaaS) entity. Such groups provide specialized malware and infrastructure to affiliates, who then carry out the attacks. It has been noted that these actors may gain access through the exploitation of VPN accounts, highlighting the critical importance of securing remote access points.

To defend against such threats, organizations typically need to review their data security processes and notify the affected parties. Common defensive measures include implementing multi-factor authentication (MFA) on all remote access points, such as VPNs, to prevent unauthorized access via stolen credentials. Additionally, maintaining robust, offline backups and implementing strict network segmentation can help limit the lateral movement of an attacker and the volume of data that can be exfiltrated.