On 6 November 2026, the Akira ransomware group added Ligne Roset to its leak site. Ligne Roset is the French maker of high-end furniture behind the Togo sofa. Akira says it stole 150GB of company data, including employees' passports and driving licences, and says it will publish the data "soon". So far this is only a claim. Ligne Roset has not publicly confirmed an incident, no data has been released, and no regulator filing or statement from French authorities has been published. Every report so far traces back to Akira's own listing, as recorded by leak-site trackers such as RansomLook and by the French site Cyberattaque.org.
What Happened
The listing appeared on Akira's leak site on 6 November 2026. QPulse logged it at 15:33 UTC that day. Cyberattaque.org published its report at 16:58 the same afternoon, and RansomLook, the leak-site tracker cited by Vulnpocalypse, also dates the post to 6 November. QPulse gives an estimated attack date of 6 November, but Fuitededonnées.fr, citing Cyberattaque.org, notes that the actual date of the intrusion is not known. The listing date and the intrusion date should not be treated as the same thing. Ransomware groups often post victims days or weeks after they get in.
According to RansomLook's copy of the listing, Akira says it "will upload 150gb of corporate data soon". It gives no date. When Interior Daily reported on 9 November, nothing had been published.
Ligne Roset belongs to the family-owned Roset group, which is based in Briord in the Ain department. Cyberattaque.org says the company runs five factories in the Ain, Rhône and Isère departments and sells through an international distribution network. None of the reports say which entity or systems were affected, or whether production, retail or e-commerce operations have been disrupted. Nobody has said whether any systems were encrypted.
What Was Taken
Every report gives the same volume: 150GB. That figure comes from Akira alone and has not been checked by anyone else. FrenchBreaches.com's alert headline says "150 comptes exposés" (150 accounts exposed), and its summary lists "150 personnes" (150 people) as affected. Its own article text, however, says 150 Go (gigabytes). This looks like a mistake in turning the claimed data volume into a count of people. No report gives an actual number of affected individuals.
Akira says the data includes:
- Employee personal information, including copies of passports and driving licences
- Contracts and commercial agreements
- Non-disclosure agreements (NDAs)
- Financial documents
- Confidential internal files and other business documents
Akira has not released sample files publicly. Cyberattaque.org, Fuitededonnées.fr, Interior Daily and Undercode News all say the contents and the real volume have not been verified. If the claim is genuine, the identity documents are the most serious exposure. Scanned passports and licences can be used for identity fraud and account takeover, and to make phishing aimed at staff more convincing. The contracts and NDAs could also expose suppliers, designers who work with Ligne Roset, and distribution partners.
Why It Matters
Akira has been one of the most active ransomware operations since it appeared in 2023. It uses double extortion: it steals data first, then encrypts systems, and uses the threat of a leak to pressure the victim into paying. Fuitededonnées.fr describes this pattern. Mid-sized, family-owned manufacturers like Ligne Roset fit Akira's usual targets. These companies have valuable intellectual property and large partner networks, but often lack the security staff of a large enterprise.
Two points matter for defenders:
- The people exposed may extend well beyond the company. NDAs and commercial contracts name third parties. Designers, suppliers and retailers that work with Ligne Roset should assume their contract details may be in the dataset until the company says otherwise.
- There will likely be regulatory follow-up. If employees' identity documents were taken, the breach falls under GDPR, which requires the company to notify France's data protection authority, the CNIL, within 72 hours of becoming aware of it. So far no notification has been made public, and the company has not issued a statement.
The Attack Technique
Nobody has said how Akira got into Ligne Roset's network. The entry point, the timeline and the systems affected are all unknown.
Akira's known methods give useful context, although they say nothing specific about this case. Fuitededonnées.fr notes that the group has historically exploited vulnerable VPN appliances and compromised credentials. A separate Akira investigation published by Huntress in October 2026 describes a September intrusion at another organisation. It has nothing to do with Ligne Roset. In that case, the attacker:
- Logged in to the endpoint over Remote Desktop Protocol (RDP)
- Disabled antivirus before going further
- Used Rclone to copy data out of the network
- Installed the GOST tunnelling tool, probably to keep access
- Deployed the Akira encryptor last
Huntress also pointed out a practical problem. Its agent was installed only after the compromise, so it missed the initial access and early reconnaissance. Investigators had to rebuild the timeline from Registry data and Akira's own log files. Organisations that deploy endpoint detection only during an incident should expect the same gaps.
What Organizations Should Do
- Lock down remote access. Patch VPN appliances quickly, require multi-factor authentication on all VPN and RDP access, and do not expose RDP directly to the internet. Check VPN logs for logins from unusual locations or at unusual times.
- Watch for the tools used to steal data. Alert when Rclone, GOST or similar sync and tunnelling tools run, and on large or sustained outbound transfers to cloud storage providers you do not use.
- Alert on attempts to disable security tools. Treat any attempt to turn off antivirus or EDR, or to tamper with its settings, as a likely active intrusion rather than routine noise.
- Limit where identity documents are stored. Keep scanned passports and licences in a restricted, monitored HR system, not on general file shares, and delete copies you no longer need.
- Partners of Ligne Roset should prepare now. Look out for invoice fraud and impersonation that cite real contract details. Confirm any request to change payment details through a contact you already know.
- Ligne Roset employees should watch for phishing that uses their personal details, consider placing fraud alerts where available, and rely only on official company channels for updates. They should not try to download any data Akira publishes.
Sources: 150GB of data at risk as luxury furniture brand Ligne Roset hit by... | Up a Creek Without a Command Line: Mapping an Akira Ransomware Atta... | Akira Ransomware Group Claims Data Exfiltration Attack Against Lign... | Ligne Roset : 150 Go de documents confidentiels menacés de publicat... | Ligne Roset claimed by Akira ransomware group Vulnpocalypse | Ligne Roset : 150 comptes exposés par ransomware | Ligne Roset : passeports de salariés parmi 150 Go revendiqués par A... | Akira Ransomware Claims 150GB Data Theft from French Luxury Furnitu...