Fiskars confirms cyber security incident, says operations unaffected

Fiskars Group, claimed by the Akira Ransomware gang, has released a statement confirming that the company “has been subject to a cybersecurity incident which has impacted a small number of the company’s systems in the US.”

Fiskars states that the company’s operations have not been affected, and its business continues to operate as usual.

“As soon as Fiskars Group became aware of the incident, it took immediate containment steps and successfully managed to stop the incident in its tracks. The investigation into the incident and impact to data is ongoing,” the company said.

Fiskas Group has notified law enforcement and continues to assist with their investigations.

It’s unclear if the incident exposed any personal data.

On May 14th, Akira Ransomware, a prominent threat actor, posted Fiskars Group on its victim site, claiming that it stole 2TB of data, including “different sensitive documents.”

“We've taken 2TB of data. Should I list everything interesting what we copied from their servers? I suppose it is obvious that there are lots of different sensitive documents you are interested in. We'll provide you with the access to the files as soon as possible,” Akira’s post on dark web reads.

Fiskars Group, headquartered in Helsinki, Finland, is a global supplier of consumer goods under the brands of Fiskars, Georg Jensen, Gerber, Iittala, Moomin Arabia, Royal Copenhagen, Waterford, and Wedgwood. The company is present in more than 100 countries and has close to 450 stores. Fiskars Group has approximately 7,000 employees, and its global net sales in 2023 were €1.1 billion.

According to the Cybernews Ransomlooker tool, Akira Ransomware was among the most active ransomware gangs in 2023, claiming a total of 169 victims.

In less than a year of operations, the gang has claimed approximately $42 million in ransomware proceeds from more than 250 affected organizations, according to the Federal Bureau of Investigation (FBI) and other authorities. Among the largest victims of Akira were Japanese auto giant Nissan – which notified 100,000 individuals about a cyber breach – Stanford University, which allegedly lost 430GB of internal data, and Nassau Bay, a city in Texas.