Keller Laser AG data allegedly leaked by Akira ransomware group

• Ransomware group: Akira
• Country: Switzerland
• Sector: Technology
• Announcement date: September 8, 2025

Akira ransomware group claims data breach at Keller Laser AG

The Akira ransomware group has claimed responsibility for a data breach involving the technology company Keller Laser AG. According to an announcement made on the group's leak site, the attackers have listed a significant amount of data allegedly stolen from the organization. This development follows a pattern of behavior observed in modern ransomware operations where stolen information is used as leverage against the victim.

Details of the alleged leak

The announcement regarding the breach was published on September 8, 2025. Based on the information provided by the threat actor, the attack is claimed to have occurred on August 18, 2025. The group claims to have exfiltrated approximately 9 GB of data from the organization's systems.

The group has not provided any screenshots to verify the contents of the stolen data. However, they have specified the nature of the information they claim to possess. The leaked data is said to consist primarily of technical drawings related to industrial sheet metal processing. The specific items identified in the listing include:

• Technical drawings

About Keller Laser AG

Keller Laser AG is an owner-managed company based in Switzerland. Operating since 1995, the organization specializes in the field of industrial sheet metal processing. The company is recognized as one of the leading suppliers within the sheet metal processing industry.

Potential impact and security implications

This alleged leak may pose a significant risk to the organization's intellectual property and trade secrets. Because the leaked data is said to consist primarily of technical drawings, the potential exposure of these files could negatively impact the company's market competitiveness if they are misused by competitors. Such a scenario highlights the vulnerability of specialized manufacturing firms to targeted cyberattacks aimed at stealing proprietary designs.

Furthermore, as the organization is based in Switzerland, the incident may trigger legal processes under the General Data Protection Regulation (GDPR) and local data protection regulations. The nature of the threat also involves the risk of indirect security consequences for the organization's supply chain partners. This is a common concern when dealing with ransomware groups that utilize double-extortion tactics. In double-extortion, attackers not only encrypt systems but also threaten to release sensitive data to pressure the victim into paying the ransom.

The Akira group is known for frequently exploiting vulnerabilities in Virtual Private Networks (VPNs) to gain unauthorized access to networks. This specific method of entry underscores the importance of robust perimeter security. For organizations in the technology and manufacturing sectors, this situation may necessitate a comprehensive review of their cybersecurity infrastructure to defend against similar intrusion vectors.

In general, when organizations face such threats, common defensive steps include implementing multi-factor authentication, ensuring all VPN software is patched against known vulnerabilities, and maintaining strict monitoring of network traffic for unusual data exfiltration patterns. The exposure of technical data specifically highlights the need for enhanced protections around intellectual property and sensitive engineering files to prevent competitive disadvantage.