Tom Duffy Company listed on Akira ransomware leak site

• Ransomware group: Akira
• Country: United States
• Announcement date: September 30, 2025

Akira ransomware group claims data breach at Tom Duffy Company

The Akira ransomware group has listed Tom Duffy Company on its dedicated leak site, claiming to possess a significant amount of corporate data. According to the announcement made on September 30, 2025, the threat actors allege they have successfully compromised the network of the US-based organization.

The group claims that the stolen data amounts to approximately 7 GB. This alleged breach involves various corporate documents that could impact the company's operations. While the group has announced the theft, they have not disclosed any specific ransom demand or provided details regarding payment processes in their announcement.

Details of the alleged data theft

The information allegedly leaked by the Akira group is quite extensive and covers several sensitive categories. Based on the claims made by the attackers, the stolen data includes a variety of internal and external information. No screenshots were provided by the group to verify the contents of the leak.

The data types mentioned in the claim include:

• Employee personal data
• Customer information
• Partner information
• Financial records
• Agreements and contracts

The exposure of such diverse datasets, ranging from individual personal identifiers to high-level corporate agreements, represents a significant breach of confidentiality for the targeted organization.

About Tom Duffy Company

Tom Duffy Company is a supplier and service provider specializing in floor covering materials, ceramic tile, stone setting, and floor heating systems. The company operates within the United States, providing essential materials and specialized services for flooring and installation needs.

Impact and security implications

This alleged leak may increase the risk of identity theft and targeted phishing attacks for the company's employees and customers. The exposure of corporate financial data and non-disclosure agreements (NDAs) could damage the company's commercial reputation and lead to potential legal liabilities. As the company is based in the US, state-level data protection laws and potential notification requirements may apply.

Given the Akira group's known use of double-extortion tactics, the publication of this data could pose a secondary threat. Double extortion is a common ransomware tactic where attackers not only encrypt a victim's data but also steal it, threatening to leak it publicly if the ransom is not paid. This method increases the pressure on organizations, as they face the risk of reputational damage and regulatory scrutiny even if they can restore their systems from backups.

Public information about the Akira group remains limited; however, they are known to frequently exploit VPN vulnerabilities to gain network access. This highlights a common trend in modern cyberattacks where vulnerabilities in remote access tools are leveraged to bypass perimeter security. Organizations can defend against such threats by implementing multi-factor authentication (MFA) on all remote access points, maintaining rigorous patch management schedules for VPN gateways, and monitoring network traffic for unusual patterns that might indicate unauthorized access or data exfiltration.

General defensive considerations

When facing threats from groups that utilize data exfiltration, organizations often focus on robust data loss prevention (DLP) strategies and comprehensive logging to detect unauthorized movement of sensitive files. Strengthening identity and access management (IAM) protocols is also a critical component of a modern security posture to mitigate the risk of credential theft and subsequent lateral movement within a network.