Deas Millwork Data Breach

Deas Millwork, a company operating within the manufacturing sector, specifically in millwork and building materials, has been identified as a victim of the Akira ransomware group. The group published this listing on their dark web portal on August 20, 2026, as observed by SOCRadar’s Dark Web Monitoring service. This incident places Deas Millwork among numerous manufacturing firms that have recently been targeted by Akira, suggesting that this sector remains a significant focus for the ransomware operation. In the 60 days preceding this listing, Akira ransomware claimed responsibility for attacks against 44 other victims. The group’s targeting has predominantly focused on the Business Services, Manufacturing, and Technology industries, with a notable concentration of victims located in the United States, the United Kingdom, and Canada. Deas Millwork’s profile aligns with other recent manufacturing victims of Akira, such as Alcast, Pharma Test Apparatebau AG, University SprinklerSystems, and Albers Mechanical Contractors. This incident is consistent with Akira’s operational pattern of high-volume attacks across diverse sectors.

SOCRadar’s analysis of initial access vectors using its stealer-log telemetry returned no records associated with the domain deasmillwork.com within the queried dataset. It is crucial to note that a null result from such a query does not definitively confirm that the organization is unaffected. The absence of evidence in this specific search does not rule out the possibility of credential compromise, as data may exist in other threat feeds not covered by this query, credentials might have been utilized and rotated prior to indexing, or they could have been harvested using personal email aliases rather than the primary corporate domain. Ransomware groups like Akira frequently leverage infostealer-harvested credentials as a primary method for initial access. Threat actors or initial access brokers typically acquire these credentials from underground marketplaces, validate their authenticity, and then use them to gain unauthorized access to systems such as Microsoft 365, VPNs, or remote-access portals. Following this initial compromise, they proceed to deploy ransomware. Therefore, the lack of findings in this particular query should not be interpreted as an indication that a compromise has not occurred. Given these considerations, CTI teams are advised to continue dark web and stealer-log monitoring. Proactive credential hygiene checks, including password rotation and thorough review of multi-factor authentication configurations, are recommended. Monitoring of Microsoft 365, VPN, and remote-access portal activity, as well as alternative corporate domains, remains essential to detect any potential signs of intrusion or compromise.

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.