Sobotec listed on Akira ransomware leak site

• Ransomware group: Akira
• Country: Canada
• Sector: Manufacturing
• Announcement date: October 3, 2025

Akira ransomware group claims breach of Sobotec

The Akira ransomware group has listed the Canadian manufacturing company Sobotec on its dedicated leak site. According to the announcement made on October 3, 2025, the threat actor group claims to have successfully accessed the company's systems. The group asserts that they have obtained a significant volume of data, specifically claiming to have exfiltrated over 277 GB of information from the organization's network.

Ransomware leak sites are platforms used by cybercriminal groups to pressure victims into paying ransoms. In these scenarios, the attackers often employ a tactic known as double extortion. This method involves not only encrypting the victim's files to disrupt operations but also stealing sensitive data before the encryption occurs. The threat of releasing this stolen information publicly on a leak site serves as additional leverage to compel the organization to meet the attackers' demands.

Details of the alleged data theft

While the group has not provided any screenshots to verify their claims, the announcement specifies the types of sensitive information they allege to have stolen. The group claims that the compromised data includes a wide range of sensitive records that could impact various stakeholders within the company. The alleged data types include:

• Financial data
• Employee personal data
• Customer personal data
• Passport information
• Social Security Numbers

The specific contents of the data are reported to include financial records such as audits, payment details, financial reports, and invoices. Furthermore, the group claims to have access to confidential information and non-disclosure agreements (NDAs), as well as personal details for both employees and customers, including emails, phone numbers, and sensitive identification numbers.

About Sobotec

Sobotec is a company based in Canada that has been in operation since 1988. The organization specializes in the design and manufacture of modern wall panel systems that utilize metal composite material (MCM). They are particularly recognized for their development of the Rainscreen Wall Panel System, which is specifically designed for the use of ALUCOBOND® material.

Analysis and potential implications

This alleged breach poses significant risks to the individuals whose information may have been compromised. The exposure of sensitive identifiers, such as passport information and Social Security Numbers, increases the risk of identity theft for both Sobotec employees and its customers. For an organization operating within Canada, such an incident may trigger specific regulatory obligations and potential penalties under the Personal Information Protection and Electronic Documents Act (PIPEDA).

The use of double-extortion tactics by the Akira group suggests that the leaked data could be utilized in secondary attacks. This might include highly targeted phishing campaigns or other forms of social engineering aimed at the company or its partners. Additionally, the exposure of financial documents can lead to substantial reputational damage and may introduce vulnerabilities into the broader supply chain.

While information regarding the specific methods used by the Akira group remains limited, their known patterns suggest that vulnerabilities in Virtual Private Networks (VPNs) are often exploited during such incidents. To mitigate these types of risks, organizations in the manufacturing sector can implement several defensive measures. These include enforcing multi-factor authentication (MFA) across all remote access points, maintaining rigorous patch management schedules to close known vulnerabilities, and conducting regular security awareness training to help employees recognize phishing attempts. Furthermore, robust data encryption and network segmentation can help limit the scope of an intrusion and protect sensitive assets from being easily exfiltrated.