VULNpocalypse
LowBreach / campaignMonitoring

Ligne Roset: Akira ransomware group claims attack on its leak site, according to RansomLook

The Akira ransomware group claims Ligne Roset on its leak site, per RansomLook. It is unconfirmed, so watch for an official notice from the company.

Published
Exploitation
No, not confirmed: the only evidence is a leak-site listing recorded by RansomLook

What happened

The Akira ransomware group claims Ligne Roset as a victim on its leak site, according to the tracker RansomLook. RansomLook lists the post on 2026-11-06.

According to RansomLook’s copy of the listing, Akira says it “will upload 150gb of corporate data soon.” The group says this includes employee personal information such as passports and driving licences, contracts and agreements, financial and confidential files, and NDAs (RansomLook).

What is not confirmed:

  • Ligne Roset has not confirmed an incident in the sources provided.
  • No independent outlet has reported or verified the claim. The only source is a leak-site tracker.
  • The entry point, the timing of any intrusion, and whether any data was actually taken are not confirmed. The data volume and contents come only from the group’s own listing.

Am I affected?

Not confirmed. If the claim is accurate, the listing points to Ligne Roset employees, whose identity documents are named. It also points to parties to the company’s contracts and agreements. The sources do not identify any specific product, system or customer group.

What to do now

  1. Do not treat the listing as proof. Wait for a statement from Ligne Roset before assuming your data is involved.
  2. If you are a Ligne Roset employee or business partner, follow official communications from the company and check that any message about this incident comes through a channel you already know.
  3. Do not download or seek out any data the group may publish.

Sources