Watkins Steel targeted by Akira ransomware group

• Ransomware group: Akira
• Country: Australia
• Sector: Manufacturing
• Announcement date: April 30, 2025

The Akira ransomware group has claimed responsibility for a data breach involving the Australian manufacturing company Watkins Steel. According to an announcement posted on the group's leak site on April 30, 2025, the threat actors allege that they have successfully exfiltrated a significant amount of sensitive information from the organization.

Details of the alleged attack

The threat actor claims that the intrusion occurred on April 10, 2025. The Akira group has listed approximately 17 GB of data on their leak site, asserting that this information belongs to Watkins Steel. The announcement indicates that the stolen data is currently prepared for publication, a common tactic used by ransomware groups to exert pressure on their victims.

Ransomware groups often utilize leak sites to host information obtained during a breach. These sites serve as a public platform to shame organizations and increase the pressure to pay a ransom. This specific incident follows the pattern of double extortion, a strategy where attackers not only encrypt an organization's systems but also steal sensitive data to threaten its public release. By threatening to publish confidential information, attackers aim to maximize their leverage during negotiations.

The scope of the leaked data

While no screenshots were provided to verify the contents of the breach, the Akira group has specified the types of information they claim to have stolen. The alleged leak includes a variety of sensitive files that could impact multiple stakeholders within the organization and its business network. The claimed data types include:

• Employee personal files
• Client data
• Project information
• Financial data (including audits, tax statements, payment details, and reports)
• Corporate NDAs

The presence of such diverse data types suggests a deep penetration into the organization's file servers and administrative systems. The inclusion of financial records and non-disclosure agreements is particularly significant for business operations.

About Watkins Steel

Watkins Steel is an Australian-based company that operates within the manufacturing sector. The organization provides metal products and steel fabrication services specifically tailored for the construction industry. Their expertise lies in structural steel works and metal manufacturing, making them a specialized provider for large-scale building and construction projects.

Potential impacts and security implications

The alleged exposure of this data carries significant risks for both the organization and the individuals involved. For employees and clients, the leak of personal and client data may lead to risks such as identity theft or the execution of highly targeted phishing attacks. Furthermore, the exposure of financial data, such as tax statements and payment details, and corporate non-disclosure agreements (NDAs) could potentially impact the institution's commercial operations and its overall reputation.

From a regulatory perspective, the organization may face specific obligations. Under Australian data protection regulations, the exposure of such sensitive information may trigger mandatory notification requirements and subsequent legal proceedings. The complexity of these legal obligations highlights the importance of robust data governance and incident response planning.

The Akira group has demonstrated a tendency to exploit VPN accounts to gain initial access to networks. This specific method of entry suggests that organizations in the manufacturing and construction sectors should prioritize a thorough review of their network security processes. Strengthening authentication methods, such as implementing multi-factor authentication on all remote access points, is a common defensive step to mitigate the risk of unauthorized access via stolen credentials. Additionally, continuous monitoring of network traffic and strict access controls can help detect and prevent the exfiltration of large volumes of data, such as the 17 GB claimed in this incident.