Lone Rock Timber listed on Akira ransomware leak site

• Ransomware group: akira
• Country: United States
• Sector: Manufacturing
• Announcement date: November 28, 2025

Akira ransomware group claims data breach against Lone Rock Timber

The Akira ransomware group has officially listed Lone Rock Timber on its dedicated leak site. According to the announcement, the threat actors claim to have successfully compromised the company's internal data, leading to a significant exfiltration incident. The notification, which appeared on the group's platform on November 28, 2025, alleges that the attackers have gained access to a substantial volume of corporate information.

This incident follows a pattern observed in modern cyberattacks where threat actors target specific organizations to extract sensitive information. Ransomware leak sites serve as a public stage for these groups, where they post the names of their victims to exert pressure. In this specific case, the group asserts that they have secured a dataset totaling 25 GB in size. While the announcement confirms the claim of a breach, the actual scope and validity of the stolen data remain subject to verification through further investigation.

Details of the alleged data exfiltration

The threat actor behind the Akira group claims to have stolen a vast array of corporate documents during the intrusion. The announcement suggests that the stolen information is not limited to a single category but spans several critical business functions. This type of broad data theft is often used to increase the leverage held by the attackers during negotiations.

According to the claims made by the group, the leaked data is said to include the following types of information:

• Personal employee data
• Financial records
• Agreements and contracts

It is important to note that, despite the claims of a 25 GB breach, no screenshots were provided by the attackers to substantiate the contents of the stolen files. Furthermore, the group has not disclosed a specific ransom demand in their public announcement. The exact nature of the breach and the integrity of the claimed files can only be fully clarified following a comprehensive investigation by the affected organization.

About Lone Rock Timber

Lone Rock Timber is an organization based in the United States, specifically operating out of Oregon. The company is active in the forestry and timber industry, focusing on the fields of sustainable forest management and the production of various timber products. As a player in the manufacturing and resource management sector, the company handles various operational, financial, and personnel-related documents essential to its business processes.

Analysis and implications of the incident

This incident appears consistent with the double-extortion strategy frequently employed by the Akira group. In a double-extortion scenario, attackers do not merely encrypt an organization's systems to disrupt operations; they also steal sensitive data to threaten its public release. This tactic is designed to create maximum pressure on the victim, as the threat of leaking private information can be more damaging than the operational downtime caused by encryption.

The alleged exposure of employee data and financial documents creates significant secondary risks. For the individuals whose personal information may have been taken, there is an increased risk of identity theft or targeted phishing attacks. For the organization and its stakeholders, the leak of financial records and contracts can lead to various legal and operational complications. Given that Lone Rock Timber is based in the United States, this potential breach may lead to legal consequences under both state laws and federal regulations regarding data protection and privacy.

The group has a known history of gaining network access through methods such as exploiting VPN accounts or utilizing phishing campaigns. This suggests that vulnerabilities within the organization's security infrastructure may have been the entry point for the attackers. To defend against such threats, organizations in the manufacturing and forestry sectors often implement defensive measures such as multi-factor authentication, regular security audits, and enhanced monitoring of remote access points to mitigate the risk of unauthorized entry.