[AKIRA] – Ransomware Victim: Mecanex USA
NOTE: No files or stolen information are exfiltrated, downloaded, taken, hosted, seen, reposted, or disclosed by RedPacket Security. Any legal issues relating to the content should be directed at the attackers, not RedPacket Security. This blog is an editorial notice informing that a company has fallen victim to a ransomware attack. RedPacket Security is not affiliated with any ransomware threat actors or groups and will not host infringing content. The information on this page is automated and redacted whilst being scraped directly from the AKIRA Onion Dark Web Tor Blog page.
AI Generated Summary of the Ransomware Leak Page
On November 3, 2025, a leak post attributed to the AKIRA group targets Mecanex USA, a U.S. manufacturing entity. The post frames Mecanex USA as a U.S. subsidiary within a larger aviation organization and states that the attackers intend to upload 24 GB of corporate documents in the near term, signaling a data-exfiltration event rather than a purely encrypted incident. The material described as exposed includes sensitive employee information (such as social security numbers, passport data, driver’s license numbers, phone numbers, and home addresses), confidential military information, a large collection of contracts and agreements (including military contracts), information on how to work with explosive materials, and NDAs. Taken together, the post emphasizes a potential data-leak scenario with significant risk to personnel privacy and defense-related materials.
The post does not provide any screenshots or images, and there is no stated ransom amount or demand in the posted content. The temporal marker available is the post date, which is November 3, 2025; no compromise date is disclosed, so this date is treated as the post date. The content centers on the manufacturing sector in the United States and underscores the risk that employee PII and confidential materials—some of which may be sensitive or defense-related—could be released publicly. There are no visible download links or corroborating files within the post, suggesting the attackers’ data-release timeline is the primary claim at this stage.
Support Our Work
A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.
If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.
