MGM Transformer listed on Akira ransomware leak site

• Ransomware group: Akira
• Country: United States
• Sector: Manufacturing
• Announcement date: August 6, 2025

Akira group claims data breach at MGM Transformer

MGM Transformer has been listed on the Akira ransomware group's leak site, with claims that over 60 GB of data has been compromised. The threat actor alleges that they have obtained corporate documents and has claimed to have exfiltrated more than 60 GB of data from the organization.

On August 6, 2025, the Akira group listed MGM Transformer on its leak site. The group appears to be employing a double-extortion strategy to exert pressure on the company. In a double-extortion scenario, threat actors do not merely encrypt an organization's systems to disrupt operations; they also steal sensitive information to threaten the public release of that data, using the fear of reputational damage or regulatory scrutiny to coerce the victim into paying a ransom.

Details of the alleged data exfiltration

The announcement made by the threat actor mentions a wide variety of sensitive information. While no screenshot was provided to verify the contents of the breach, the group claims to have accessed several categories of highly sensitive documents. The information allegedly stolen includes financial reports, audits, invoices, and payment details.

Furthermore, the listing claims to include sensitive personal information belonging to both employees and customers. The specific types of data identified in the claim include:

• Financial data
• Employee personal data
• Customer personal data
• Medical records
• Passport information
• Driver's license information
• SSN

About MGM Transformer

MGM Transformer is an American company that manufactures medium voltage dry-type, oil-filled, and custom-designed transformers. Their products serve various critical sectors, including data centers, renewable energy, commercial industrial facilities, and utilities.

Analysis and potential impact

The alleged breach may pose significant risks of identity theft and targeted phishing attacks for both employees and customers. Given the nature of the data involved, legal implications under US data protection regulations and state laws may arise. The double-extortion tactics used by the Akira group could negatively impact the organization's operational continuity and reputation.

The company may need to conduct a forensic investigation to determine the scope of the potential data exposure. As Akira is known to target Windows and Linux environments, often exploiting VPN vulnerabilities, a comprehensive review of the organization's network security posture may be warranted. Organizations in similar sectors often focus on hardening their remote access points and implementing strict monitoring to detect unauthorized exfiltration of large data volumes.