Thornton EngineeringAustralia Pty Ltd targeted by Akira ransomware group

• Ransomware group: Akira
• Country: Australia
• Sector: Manufacturing
• Announcement date: February 24, 2025

Akira ransomware group claims data breach at Thornton EngineeringAustralia Pty Ltd

The Akira ransomware group has listed Thornton EngineeringAustralia Pty Ltd on its leak site, claiming to possess corporate data. According to the announcement, the group has targeted the Australian-based organization and asserts that it has successfully exfiltrated a significant amount of sensitive information.

The claim, which was published on February 24, 2025, alleges that the group has targeted the company and intends to leak the stolen documents. The group claims that the volume of the compromised data amounts to over 11 GB. While the group has made this announcement, no screenshots were provided to verify the contents of the alleged breach.

Details of the alleged data theft

The Akira group claims to have obtained a variety of sensitive corporate documents. According to the group's announcement, the stolen data includes various types of information that could impact both the company's internal operations and its external relationships. The specific categories of data mentioned in the claim include:

• Employee contact information
• Customer contact information
• Financial data

The group further alleges that the stolen information encompasses financial audits, payment records, and various reports. The exact file count and the specific ransom demand associated with this incident were not disclosed in the announcement.

About Thornton EngineeringAustralia Pty Ltd

Thornton Engineering is an engineering firm specializing in the design and fabrication of structural steel, pressure vessels, heat exchangers, and steel plate products for major projects across Australia. The company provides specialized engineering solutions for large-scale industrial requirements within the region.

Analysis and potential implications of the breach

This alleged breach may pose secondary risks such as identity theft or targeted phishing attacks for the company's employees and customers. The exposure of financial data could negatively impact the company's business operations and may trigger regulatory scrutiny under the Australian Privacy Act 1988. Because the Akira group is a known Ransomware-as-a-Service (RaaS) entity, it often employs double-extortion tactics. In such scenarios, attackers not only encrypt a victim's systems but also steal sensitive data to threaten the victim with public exposure if a ransom is not paid.

Akira is known to frequently gain access to networks through compromised VPN accounts. This highlights a common vulnerability in modern remote-access infrastructures. For organizations in the manufacturing and engineering sectors, such incidents underscore the importance of maintaining a robust security posture. General defensive measures often include implementing multi-factor authentication on all remote access points, such as VPNs, to prevent unauthorized entry via compromised credentials.

To mitigate potential legal and operational risks, it is advisable for organizations to review their security posture and notify affected parties. Regular monitoring of network traffic and the implementation of strict access controls are standard industry practices to defend against the types of intrusion often utilized by RaaS groups. Proactive communication with stakeholders can also help manage the fallout of potential identity theft or phishing campaigns that may arise following a data leak.