Mercury Paper Inc targeted by Akira ransomware group

• Ransomware group: Akira
• Country: United States
• Sector: Manufacturing
• Announcement date: February 27, 2025

Akira ransomware group claims data theft from Mercury Paper Inc

The Akira ransomware group has published an announcement on its leak site regarding an alleged cyberattack against Mercury Paper Inc. According to the group's claims, they have exfiltrated a significant amount of corporate information, totaling over 100 GB of data. This announcement, made on February 27, 2025, marks a potential major security incident for the organization.

The incident involves a claim of data exfiltration rather than a direct encryption-only attack, which is a common characteristic of modern ransomware operations. In such scenarios, threat actors focus on stealing sensitive information to use as leverage during negotiations. This method, often referred to as double extortion, places immense pressure on an organization by threatening to release private data to the public if a ransom is not met.

Details of the alleged data exfiltration

The Akira group claims to have gained access to a wide array of sensitive files belonging to the company. The group's announcement specifies that the stolen data includes various types of highly sensitive information that could impact the organization's internal operations and external relationships. While the group has not provided any screenshots to verify the contents of the stolen data, they have detailed the categories of information they claim to possess.

The data allegedly stolen by the group includes the following:

• Financial data, such as audits, payment details, and reports
• Employee contact information
• Customer contact information
• Corporate agreements and licenses

The breadth of this alleged theft suggests that the attackers may have targeted core business functions, ranging from financial management to human resources and legal departments. The presence of contact information for both employees and customers introduces significant privacy concerns for the individuals involved.

About Mercury Paper Inc

Mercury Paper Inc is a manufacturing company that produces bath tissue and paper towels. The company provides contract manufacturing services for FIORA, which is recognized as one of the fastest-growing brands in the United States. Given its role in the manufacturing supply chain and its service to major brands, the company plays a significant role in its sector.

Implications and security considerations

This incident presents a risk of sensitive data exposure that could lead to significant consequences for the organization. The alleged exfiltration of personal and financial information may expose employees and customers to secondary risks such as identity theft or targeted phishing campaigns. Because the organization is based in the United States, the breach may trigger various state-level data breach notification laws and federal regulations regarding the protection of consumer and employee data.

The group's history of exploiting VPN vulnerabilities suggests that the organization's network security posture may require a comprehensive review. For organizations in the manufacturing sector, such incidents highlight the importance of robust perimeter defenses and the monitoring of remote access points. Securing the network against unauthorized access is a critical component of maintaining operational continuity and protecting corporate reputation.

When facing such threats, organizations typically focus on several defensive pillars. Strengthening identity and access management is essential to ensure that only authorized users can access sensitive data. Furthermore, implementing strict monitoring of data egress can help detect large-scale exfiltration attempts before they are completed. As ransomware groups continue to evolve their tactics, particularly through double extortion, maintaining a strong security posture and a clear incident response plan remains a vital necessity for industrial and manufacturing entities.