Mabetex Group targeted by Akira ransomware group

• Ransomware group: Akira
• Country: Switzerland
• Sector: Manufacturing
• Announcement date: April 8, 2026

The Akira ransomware group has listed 42 GB of data allegedly belonging to Mabetex Group on their leak site. This announcement, made on April 8, 2026, indicates a significant potential data breach involving the international construction firm.

The claims made by the Akira group

According to the listing, the Akira group claims to have successfully gained access to the systems of Mabetex Group. The threat actors assert that they have exfiltrated corporate data from the organization's network. The group has announced that the stolen data, which is claimed to be 42 GB in size, will be published in the near future.

The listing suggests that the stolen information contains sensitive details regarding the international projects and operations of the company. While the group has claimed to have accessed the systems, no screenshot was provided to verify the contents of the breach. The group's specific ransom demand remains unknown.

The data allegedly involved in the breach

The information provided by the threat actors suggests that the exfiltrated data includes a variety of sensitive documents. The listing specifies that the following types of information are contained within the 42 GB of data:

• Employee passports
• Employee personal data
• Financial records
• Client information

The presence of such diverse data types—ranging from personal identification to corporate financial records—highlights the potential impact of the alleged exfiltration. As noted, the group has not provided visual evidence to support their claims regarding the specific files stolen.

About Mabetex Group

Mabetex Group is an international construction company specializing in the design, construction, and engineering of administrative and governmental buildings. Their expertise also extends to projects within the health, sports, and tourism sectors. The company is known for executing large-scale infrastructure and architectural projects on a worldwide scale.

Analysis and potential implications

This incident may pose a significant risk of identity theft for Mabetex Group employees due to the alleged exposure of passports and personal data. Furthermore, the exposure of financial and operational data could negatively impact the company's trade secrets and its overall competitive advantage in the global market.

Because the company is based in Switzerland, a potential breach of this nature could trigger legal proceedings under the General Data Protection Regulation (GDPR) and other local data protection regulations. The use of double-extortion tactics by the Akira group—where data is both encrypted and stolen to leverage a ransom—may lead to secondary phishing attacks and increased supply chain risks once the data is published. Public information regarding the Akira group remains limited.

In general, when organizations face such threats, defensive measures often include implementing multi-factor authentication, maintaining offline backups, and conducting regular security awareness training to prevent phishing. For companies in the manufacturing and construction sectors, protecting intellectual property and client documentation is vital to maintaining operational integrity and trust.