iSMA CONTROLLI listed on Akira ransomware leak site

• Ransomware group: Akira
• Country: Poland
• Sector: Manufacturing
• Announcement date: February 16, 2026

Akira ransomware group claims attack on iSMA CONTROLLI

The manufacturing company iSMA CONTROLLI has been listed on the leak site of the Akira ransomware group. This announcement, made by the threat actors, marks a potential significant data breach for the organization. While the listing has been made public by the group, the specific details regarding the volume of data or the specific ransom demands remain unknown at this time.

The incident was officially announced on the Akira leak site on February 16, 2026. According to the claims made by the threat actors, the actual attack or unauthorized access occurred on February 3, 2026. This indicates that the attackers may have had access to the network for approximately two weeks before the public announcement was posted on their platform.

Claims regarding stolen data and the nature of the event

The Akira group has asserted that they will soon publish various types of sensitive information belonging to the organization. Although no screenshots were provided to verify the contents of the stolen files, the threat actors claim that the breach involves a variety of critical business information. The group's intent appears to be the public release of these files if their demands are not met.

The specific categories of data that the threat actors claim to have compromised include:

• Corporate data
• Client files
• Project specifications

In many ransomware scenarios, groups utilize a tactic known as double extortion. This method involves not only encrypting an organization's systems to disrupt operations but also stealing sensitive data to use as leverage. By threatening to leak the information publicly, attackers aim to pressure the victim into paying a ransom to prevent reputational damage, legal consequences, or the loss of intellectual property.

The organization involved

iSMA CONTROLLI is an organization operating within the manufacturing sector. Based in Poland, the company is subject to the regulatory frameworks governing data protection in that region. This includes potential obligations regarding data breach notifications and the possibility of administrative fines under the General Data Protection Regulation (GDPR) should a breach involving personal data be confirmed.

Potential risks and defensive considerations

This incident may pose a risk of sensitive data exposure or public release if ransom demands are not met. Given the Akira group's known tactics, the leaked data could potentially be used for secondary attacks or identity theft. Furthermore, the leakage of technical specifications could harm the organization's intellectual property and create negative impacts on the supply chain.

The Akira group is known to frequently exploit VPN vulnerabilities to gain network access. This highlights a common entry point for many ransomware actors, where misconfigured or unpatched Virtual Private Networks serve as a gateway into secure corporate networks. Securing remote access points is a critical defensive step for organizations to prevent unauthorized entry.

For organizations in the manufacturing sector, protecting intellectual property and technical specifications is vital to maintaining a competitive advantage and ensuring supply chain integrity. General defensive measures often include implementing multi-factor authentication, maintaining rigorous patch management for all internet-facing services, and conducting regular network monitoring to detect anomalous activity that might indicate an intruder is present on the network. Because the leakage of technical data can have cascading effects on partners and clients, robust data governance and encryption of sensitive files are also essential components of a modern cybersecurity posture.