Waukegan Steel targeted by Akira ransomware group in alleged data breach

• Ransomware group: Akira
• Country: United States
• Sector: Manufacturing
• Announcement date: November 14, 2025

Akira ransomware group claims data breach against Waukegan Steel

The Akira ransomware group has published a claim on its leak site involving the manufacturing company Waukegan Steel. According to the announcement, the threat actor group has targeted the organization, alleging that they have successfully exfiltrated a significant amount of sensitive corporate and personal data.

The claim was officially posted on the group's leak site on November 14, 2025. While the announcement was made in mid-November, the group cites the actual attack date as occurring on October 21, 2025. This indicates that the threat actors may have maintained presence within the network for several weeks prior to making their public announcement. The group has stated that the stolen data is scheduled to be published in the near future, creating a sense of urgency for the affected entity.

Details of the alleged data theft

The Akira group claims to have stolen approximately 15 GB of data belonging to Waukegan Steel. While the group has not provided any screenshots to verify the contents of the stolen files, the listing describes a wide array of sensitive information that could impact both the company and its stakeholders. The alleged breach involves a mix of highly sensitive personal identification documents and proprietary business information.

The specific types of data mentioned in the claim include:

• Passports
• Social security numbers
• Driver licenses
• W-9 forms
• Financial records
• Client information

In addition to these items, the group claims to have obtained project information, non-disclosure agreements (NDAs), and technical drawings related to ongoing projects. The inclusion of technical drawings is particularly significant for a manufacturing firm, as such documents often represent the intellectual property and core operational secrets of the business.

About Waukegan Steel

Waukegan Steel is a structural steel fabricator that has been in operation since 1929. The company is recognized for its involvement in significant construction projects within the Chicago area, including notable landmarks such as Soldier Field and the Willis Tower. The organization provides a comprehensive suite of services, encompassing structural, miscellaneous, and ornamental steel fabrication for various industrial and commercial needs.

Risk assessment and industry implications

This leak claim presents several layers of risk. First, the exposure of personal identification documents such as passports, social security numbers, and driver licenses poses a direct threat to the privacy and security of employees and clients. Such data is highly valuable for identity theft and fraudulent activities. Because Waukegan Steel operates within the United States, this potential breach may trigger legal obligations regarding data breach notifications under various state laws and federal regulations.

Beyond personal data, the alleged theft of financial records and technical drawings introduces secondary operational risks. The loss of technical drawings can compromise competitive advantages and intellectual property. Furthermore, the Akira group is known to employ double extortion tactics, a method where attackers not only encrypt systems but also threaten to leak sensitive data to pressure the victim into paying a ransom. Publicly available intelligence suggests that this group often targets vulnerabilities in Virtual Private Networks (VPNs) to gain initial access to networks.

For organizations in the manufacturing sector, such incidents highlight the importance of robust perimeter defenses and the need to secure remote access points. The threat of data exposure also creates a ripple effect through the supply chain; if a manufacturer's data is compromised, it may pave the way for targeted phishing attacks against their partners and clients. To mitigate these risks, organizations typically focus on implementing multi-factor authentication, maintaining strict patch management for all external-facing services, and ensuring comprehensive data encryption for sensitive files both at rest and in transit.