Van Eycken listed on Akira ransomware leak site

• Ransomware group: Akira
• Country: Belgium
• Sector: Manufacturing
• Announcement date: January 22, 2026

Akira ransomware group claims data breach at Van Eycken

The Akira ransomware group has officially listed the Belgian manufacturing company Van Eycken on its dedicated leak site. According to the announcement made on January 22, 2026, the threat actor group claims to have successfully exfiltrated 69 GB of data from the organization's systems. This development follows a pattern of double-extortion tactics frequently employed by modern ransomware groups, where stolen data is used as leverage to pressure victims into paying a ransom.

The claim suggests that the breach occurred on the same day the announcement was posted, January 22, 2026. While the group has publicized the existence of the stolen data, they have not provided any screenshots to verify the contents of the breach. The threat actors have indicated that the stolen information is expected to be published on their leak site in the near future, increasing the pressure on the victim organization.

Details of the alleged data exfiltration

The Akira group alleges that the compromised information spans various aspects of the company's operations. The stolen data is said to include sensitive information related to both the manufacturing and administrative processes of the organization. This type of broad access suggests that the attackers may have moved laterally through the network to access different departments.

The specific types of data identified in the group's claim include:

• Passports
• Personal documents
• HR data
• Financial records
• Project files
• Confidentiality agreements

The inclusion of highly sensitive personal identification and legal documentation highlights the potential severity of the incident. Ransomware leak sites serve as public platforms where cybercriminals post the names of their victims and the volume of data stolen to damage the victim's reputation and force compliance with ransom demands.

Organization profile: Van Eycken

Van Eycken is a manufacturing company based in Belgium. The organization provides a wide range of industrial solutions, specializing in the fields of railings, structures, bridges, vehicle barriers, and sound barriers. Additionally, their operational scope includes assembly work and various metalworking services.

Potential impact and security implications

This incident may pose significant risks of identity theft and fraud for the company's employees and business partners, particularly due to the claimed theft of passports and personal documents. Furthermore, the exposure of financial and project-related data could potentially harm the company's competitive standing and lead to regulatory consequences under the EU General Data Protection Regulation (GDPR).

The use of double-extortion tactics by the Akira group means that even if an organization can restore its systems from backups, the threat of leaking sensitive data remains a potent weapon for the attackers. This can lead to secondary attack risks once the data is actually published. While public information regarding the Akira group remains limited, it has been observed that they frequently exploit VPN vulnerabilities in similar attacks to gain initial access to corporate networks.

For organizations in the manufacturing sector, such incidents underscore the necessity of reviewing network security protocols. Implementing robust security measures, such as multi-factor authentication, regular vulnerability scanning, and strict access controls, is essential to mitigate these risks. Additionally, notifying affected individuals when personal data is compromised is a critical step in managing the fallout of a data breach and fulfilling regulatory obligations.