Wright Architectural Millwork targeted by Akira ransomware group

• Ransomware group: Akira
• Country: United States
• Sector: Manufacturing
• Announcement date: December 13, 2025

The Akira ransomware group has published a claim on its leak site regarding a data breach involving Wright Architectural Millwork. According to the announcement, the threat actor group has listed data they assert belongs to the organization, marking a significant escalation in their campaign against the target.

Details of the claimed attack

The Akira group listed data belonging to Wright Architectural Millwork on its leak site on December 13, 2025. Based on the group's claims, the data was obtained as a result of a cyberattack that was carried out on November 29, 2025. This timeline suggests a period of several weeks between the initial intrusion and the public announcement on the leak site.

Regarding the distribution of the stolen information, the group provides a torrent-based method for downloading the data. The group has also stated that the files are encrypted and require a password for access. No information was provided regarding the specific size of the data or the total file count involved in the breach. Furthermore, no information was provided regarding a specific ransom demand.

Data types involved in the leak

According to the announcement, the leaked data includes a variety of sensitive information. While no screenshot was provided to verify the contents, the group claims the following items are included in the breach:

• Employee passport numbers
• Employee driver licenses
• Employee contact information
• Financial records
• Client data
• Contracts and non-disclosure agreements (NDA)

About Wright Architectural Millwork

Wright Architectural Millwork is a manufacturing company that has been providing high-quality architectural woodwork and custom millwork services for over 50 years.

Analysis and potential impact

The data shared by the Akira group may pose secondary risks such as identity theft and targeted phishing attacks for the company's employees and clients. As the company is based in the United States, the breach may have legal implications under state-level data breach notification laws and relevant regulations. Given the group's double-extortion method, it is assessed that the leaked data is being made public due to a lack of ransom payment. Negative impacts on the company's operational continuity and reputation management may be observed.

Ransomware groups often employ a double-extortion tactic, where they not only encrypt an organization's systems to disrupt operations but also steal sensitive data to use as leverage. By threatening to release this data publicly, attackers increase the pressure on the victim to pay the ransom. This method is particularly damaging because even if an organization can restore its systems from backups, the threat of a data leak remains a significant risk to reputation and legal standing.

Public information regarding the Akira group indicates that the group has been active since 2023 and often gains access to systems by exploiting VPN vulnerabilities. Organizations in the manufacturing sector often face similar risks, as they manage complex supply chains and sensitive client contracts. To defend against such threats, organizations typically focus on securing remote access points, such as VPNs, and implementing multi-factor authentication to prevent unauthorized entry. Additionally, maintaining robust data encryption and monitoring for unusual data exfiltration can help mitigate the impact of a successful breach.