JST Power Equipment listed on Akira ransomware leak site

• Ransomware group: Akira
• Country: China
• Sector: Manufacturing
• Announcement date: February 2, 2026

The manufacturing company JST Power Equipment has been listed on the leak site of the Akira ransomware group. The threat actors claim to have targeted the organization, asserting that they have successfully exfiltrated a significant volume of data. This announcement, made on February 2, 2026, follows an alleged attack that occurred on January 5, 2026.

The claims of the Akira group

The Akira group has announced its intention to publish 70 GB of data that they allege belongs to JST Power Equipment. According to the information provided by the threat actors, the stolen data is said to contain information regarding the company's operational and administrative processes. This listing is a clear indication that the group is attempting to increase pressure on the organization through the use of double-extortion tactics.

Double-extortion is a common strategy employed by modern ransomware groups. In this method, attackers do not merely encrypt an organization's systems to disrupt operations; they also steal sensitive information before the encryption process begins. The threat actors then threaten to leak this stolen data on public forums or specialized leak sites if their demands are not met. This approach allows attackers to exert pressure through the threat of reputational damage and regulatory scrutiny, even if the organization has robust backups to restore its technical operations.

Alleged data involved in the breach

While no screenshots were provided to verify the contents of the stolen files, the group has specified the types of information they claim to possess. The allegedly leaked data is said to include a wide variety of sensitive documents and records. Based on the announcement, the following data types are involved:

• Employee information
• Financial records
• Confidential client information
• Project files
• Contracts
• Non-disclosure agreements

The breadth of this data suggests a significant breach of the organization's internal documentation. When such a diverse range of files is targeted, it often indicates that the attackers have gained access to various segments of the corporate network, including administrative and operational directories.

Impact and risk assessment

The double-extortion tactic employed by the Akira group carries the risk of exposing the organization's sensitive data to the public. This situation may create secondary risks for employees and clients, such as identity theft or targeted phishing attacks. For instance, when employee and client information is leaked, these individuals become prime targets for social engineering campaigns where attackers use stolen details to gain trust.

Furthermore, if the leaked data contains trade secrets, it could harm the company's competitive position and create negative impacts on the supply chain. In the manufacturing sector, the loss of project files and contracts can lead to the exposure of proprietary processes or strategic partnerships. The severity of the incident may lead to reputational damage and operational disruptions depending on the nature of the leaked data.

Given the group's tendency to exploit VPN accounts, it is possible that vulnerabilities exist within the organization's network security processes. Organizations can mitigate these risks by implementing multi-factor authentication (MFA) on all remote access points, such as VPNs, and by maintaining strict monitoring of network traffic for unusual data exfiltration patterns. Regular security audits and the principle of least privilege can also help limit the scope of what an attacker can access once they have gained entry to the network.