Steel Encounters, Inc. Suffers Ransomware Attack by Akira Group, Exposing Sensitive Data of 959 Individuals
On December 31, 2025, Steel Encounters, Inc., a specialty contractor based in Salt Lake City, Utah, disclosed a data breach affecting 959 individuals across the U.S. The incident stemmed from a ransomware attack by the Akira cybercriminal group, which accessed and exfiltrated sensitive data between July 27 and August 1, 2025.
The attackers claimed responsibility on August 20, 2025, posting evidence of the breach on the dark web, including 21 GB of stolen data. Compromised information may have included names, addresses, Social Security numbers, passport details, financial records, health insurance data, and medical treatment information.
Steel Encounters detected the breach after identifying suspicious network activity and launched an investigation with cybersecurity experts. By November 7, 2025, the company completed a preliminary review of the affected data and reported the incident to federal law enforcement and regulatory authorities, including the U.S. Department of Health and Human Services (HHS).
Affected individuals are being notified directly, with the company providing a dedicated helpline (1-844-574-1138) and mailing address for inquiries. The breach highlights the ongoing threat posed by ransomware groups like Akira, which continue to target organizations across industries.
Source: https://www.claimdepot.com/data-breach/steel-encounters-2026
Steel Encounters, Inc. TPRM report: https://www.rankiteo.com/company/steelfab-inc
"id": "ste1771273901",
"linkid": "steelfab-inc",
"type": "Ransomware",
"date": "7/2025",
"severity": "100",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'customers_affected': '959',
'industry': 'Construction/Engineering',
'location': 'Salt Lake City, Utah, USA',
'name': 'Steel Encounters, Inc.',
'type': 'Specialty Contractor'}],
'customer_advisories': 'Direct notifications to affected individuals, '
'dedicated helpline (1-844-574-1138), and mailing '
'address for inquiries',
'data_breach': {'data_exfiltration': 'Yes',
'number_of_records_exposed': '959',
'personally_identifiable_information': 'Yes',
'sensitivity_of_data': 'High',
'type_of_data_compromised': ['Names',
'Addresses',
'Social Security numbers',
'Passport details',
'Financial records',
'Health insurance data',
'Medical treatment information']},
'date_detected': '2025-07-27',
'date_publicly_disclosed': '2025-12-31',
'description': 'On December 31, 2025, Steel Encounters, Inc., a specialty '
'contractor based in Salt Lake City, Utah, disclosed a data '
'breach affecting 959 individuals across the U.S. The incident '
'stemmed from a ransomware attack by the Akira cybercriminal '
'group, which accessed and exfiltrated sensitive data between '
'July 27 and August 1, 2025. The attackers claimed '
'responsibility on August 20, 2025, posting evidence of the '
'breach on the dark web, including 21 GB of stolen data. '
'Compromised information may have included names, addresses, '
'Social Security numbers, passport details, financial records, '
'health insurance data, and medical treatment information.',
'impact': {'data_compromised': '21 GB of stolen data',
'identity_theft_risk': 'High',
'payment_information_risk': 'High'},
'initial_access_broker': {'data_sold_on_dark_web': 'Yes'},
'investigation_status': 'Ongoing',
'ransomware': {'data_exfiltration': 'Yes', 'ransomware_strain': 'Akira'},
'references': [{'source': 'Incident disclosure'}],
'regulatory_compliance': {'regulatory_notifications': ['U.S. Department of '
'Health and Human '
'Services (HHS)']},
'response': {'communication_strategy': 'Direct notifications to affected '
'individuals, dedicated helpline '
'(1-844-574-1138), and mailing address '
'for inquiries',
'incident_response_plan_activated': 'Yes',
'law_enforcement_notified': 'Yes (federal law enforcement)',
'third_party_assistance': 'Cybersecurity experts'},
'threat_actor': 'Akira',
'title': 'Steel Encounters, Inc. Suffers Ransomware Attack by Akira Group, '
'Exposing Sensitive Data of 959 Individuals',
'type': 'Ransomware'}