The Akira ransomware group has listed Strack Companies on its leak site, claiming it will soon publish 60GB of corporate data. The company has not publicly confirmed the claim as of writing. The filing, dated September 24, 2026, does not state how many people were affected, when any incident occurred, or list any specific categories of information.
Already exposed?
You can’t unleak data. You can take away what it’s worth.
A leaked record is where it starts, not where it ends. What turns it into your front door is the look-up sites publishing your address beside your name — and those are what an AI reads when somebody asks about you. The free scan shows you both. We write to 580 companies.
See what is exposed about you — free scan →Watch Strack Companies
Get alerted the next time Strack Companies files a breach with any US regulator — the filing, dated and sourced. A free single-company slice of Signals; no account needed.
We’ll email you only about Strack Companies’s future breach filings and how to watch a whole vendor list — not general marketing. Unsubscribe any time.
Watching your whole vendor list (50 to 500 companies, by tier) is GalaxyWarden Signals.
If the claim is accurate, the people whose records are involved are primarily current and former customers of the Minnesota-based construction firm. What this means for you today is uncertainty. A leak-site posting is an accusation, not evidence. Until independent confirmation appears or Strack Companies issues a direct notification, the safest assumption is that the claim remains unverified.
What a Ransomware Leak-Site Listing Actually Establishes
Leak sites like Akira’s are designed to pressure victims into paying by publicly naming them and promising to release data. The group controls the narrative, the volume claimed, and the description of what was taken. Many listings turn out to be recycled from earlier incidents, exaggerated, or posted without having exfiltrated the promised volume. The absence of any enumerated data categories in this record is notable; the attackers simply describe “corporate data” including employee information, projects, financials, client details, and NDAs. None of this has been independently validated.
Real confirmation would require either a direct notification from Strack Companies to affected customers or verifiable samples of customer records appearing elsewhere. Until then, this remains an unproven claim by an extortion group. The record provides no discovery date, so it is impossible to assess response times or other operational details.