Akira's leak site names Calmont Wire & Cable, a Santa Ana, California manufacturer of custom wire and cable for medical, robotics, aerospace, military and sensor customers. Ransomware.live first recorded the listing on November 8, 2026 at 17:33 UTC. As of November 9, 2026, the listing is the only public evidence of an incident: Calmont has not publicly confirmed or denied anything, and no independent researcher or authority has reported on what, if anything, happened inside the company. A listing is a claim. It is not proof of intrusion, theft, encryption or production impact. 

The claim still deserves attention from industrial security leaders, for two reasons. First, small and mid-sized manufacturers that sit upstream of regulated, high-reliability products are exactly where Akira has concentrated its listings. Second, the way a cable maker's IT environment connects to its engineering and production environment is the same question every manufacturer should be asking itself this week. The sections below separate what is established from what is alleged, then use documented Akira behavior to explain what an incident like this could look like and how to blunt it. 

Executive summary 

Direct answer. Akira has claimed Calmont Wire & Cable as a victim. The claim is unverified. Nothing public shows whether Calmont's systems were encrypted, whether data left the network, or whether production was affected. 

What the listing says, and what it does not 

The public record on this incident is one entry. Ransomware.live, which indexes ransomware leak sites without accessing the stolen data, records Akira's post under the victim name "Calmont Wire & Cable." The post describes the company as a custom wire and cable manufacturer serving medical, robotics, aerospace, military and sensor applications, and says Akira will upload 10 GB of corporate data "soon." The data categories Akira lists are employee personal information (passports, driver's licenses, Social Security numbers), contracts, customer information, financial records and NDAs. 

Two details are worth reading carefully. The "10 GB soon" wording follows the same template Akira used in other 2026 postings, such as those reported for MicroPrecision (January 16) and Spiros Industries (January 22). Template language is not evidence that a claim is false, but it means the post itself tells us little about the actual volume or content of any data Akira holds. And the "estimated attack date" of November 6 is Ransomware.live's own estimate, not a date Calmont or an investigator has given. 

Incident timeline 

Only events that sources actually support are listed. The public timeline of this incident is limited to the listing itself. 

Company profile: Calmont Wire & Cable 

Calmont is a privately held manufacturer founded in 1958 and based at 420 E. Alton Avenue in Santa Ana, California, according to its federal contractor registration (Calmont Engineering & Electronics Corp., doing business as Calmont Wire & Cable, Inc.). It designs and manufactures custom wire, cable and extruded shapes for medical, robotics, aerospace, military and sensor customers. A trade-show profile lists ISO 9001:2015, ISO 13485:2016 for medical device applications and AS9100D for aerospace, and describes applications such as patient monitoring, surgical devices, satellites and repetitive-motion robotics cables. 

Published headcount and revenue figures for Calmont conflict across directories (employee estimates range from about 17 to 51-200, and revenue figures differ by a factor of three or more between sources), so this article does not use them. What can be said safely is that Calmont is a small, specialized, build-to-order manufacturer. That profile matters more than size: custom products mean unique drawings, specifications, test records and customer-controlled requirements, none of which are interchangeable with a catalog item. 

Akira: the group behind the listing 

Akira emerged in March 2023 and runs as a ransomware-as-a-service operation, with Windows and Linux/ESXi encryptors. Researchers have noted that its code resembles the leaked Conti builder, though that is a code lineage observation, not an attribution of who operates Akira today (Blackpoint Cyber threat profile). The joint FBI, CISA, Europol and NCSC-NL advisory #StopRansomware: Akira (AA24-109A), updated November 13, 2025, reports roughly $244 million in ransom proceeds as of late September 2025. 

For industrial readers, the more relevant data is who Akira hits. Researched' Q2 2026 industrial ransomware analysis counted 1,140 ransomware incidents against industrial organizations that quarter, 747 of them in manufacturing. It ranked Akira second among established groups with 129 claims (up from 100 in Q1), "consistent" in its focus on manufacturing and industrial services across North America and Europe. Researched also found ICS equipment makers, engineers and integrators accounted for 117 incidents, and observed no case in the quarter where a ransomware operator reached the ICS stage of the kill chain or directly manipulated a control system. Disruption came from losing enterprise and virtualization systems that OT depends on. 

Documented Akira behavior 

• Initial access through edge devices and valid accounts. Akira affiliates have repeatedly entered through VPN appliances. Documented cases include Cisco VPN flaws, a July to October 2025 campaign against SonicWall SSL VPNs tied to credentials from CVE-2024-40766, and logins that succeeded even where one-time-password MFA was enabled (Arctic Wolf via BleepingComputer). Researched' Q2 2026 reporting describes continued use of compromised VPN devices and, in a reconstructed intrusion, a legacy VPN account without MFA. 

• Remote tools for movement and persistence. CISA reports legitimate remote access tools such as AnyDesk and LogMeIn, an administrative account named "itadm" created in some intrusions, and SystemBC and STONESTOP malware in some cases. 

• Data theft before encryption. Reported staging and transfer tools include WinRAR, FileZilla, WinSCP, Rclone and Ngrok tunnels. A Huntress case summarized by Researched shows an affiliate accessing a hypervisor, creating a new virtual machine that carried none of the victim's security agents, and using it to stage data and launch the encryptor. 

• Defense evasion and recovery denial. Disabling security tools and deleting shadow copies appear across Akira reporting. 

• Speed. Halcyon research reported by CyberAngel puts initial access to full encryption at under four hours in some intrusions, while the Researched-cited forensic reconstruction describes several days of quiet credential theft and backup destruction first. Both can be true; dwell time varies by affiliate. 

• Extortion. Double extortion: data theft, encryption, a Tor negotiation portal, and leak-site publication if the victim does not pay. Observed demands have ranged from about $200,000 to $4 million in Blackpoint's tracking. 

No law enforcement action naming Akira had been reported as of late August 2026 according to one secondary summary, and the group's leak-site activity continued through November. 

Akira techniques versus Calmont evidence 

The table maps documented Akira behavior to MITRE ATT&CK. The right-hand column is the point: none of these techniques is tied to Calmont by any public evidence. Treat the middle column as campaign-level intelligence for defenders. 

No indicators of compromise, hashes, domains or IP addresses specific to this listing have been published in the sources reviewed. CISA's advisory provides campaign-level IOCs in downloadable STIX files for defenders who want to hunt for Akira generally; they should not be read as Calmont-specific. 

How an intrusion at an industrial supplier could unfold 

This section is analysis, not reconstruction. Nothing public says how, or whether, anyone got into Calmont. What follows is how Akira-style intrusions generally progress against a small manufacturer, so readers can test their own environments against the same path. 

1. Initial access. The documented Akira pattern is an internet-facing remote-access service: a VPN or firewall with a known flaw, a stale account with no MFA, or credentials bought or stolen earlier. Other routes seen across ransomware generally include phishing, exposed RDP, a compromised IT provider, and, per Researched' Q2 2026 findings, social engineering over collaboration tools. For a small manufacturer, one remote-access gateway often serves employees, outside engineers and equipment vendors alike, which makes it a single point of entry for everyone. 

2. Credential access and privilege escalation. With one foothold, operators typically harvest credentials from memory or browsers, find over-privileged service accounts, and create or modify administrator accounts. In a small Active Directory estate, a single domain administrator credential is often enough to reach everything that authenticates against it, including backup consoles and hypervisors. 

3. Lateral movement. RDP, PsExec-style execution and legitimate remote-management tools let an intruder reach file servers, domain controllers, virtualization hosts, backup servers, ERP and quoting systems, and engineering workstations. Whether production-adjacent systems such as MES or HMI hosts are reachable depends entirely on how the network is segmented. That is the variable that decides blast radius. 

4. Discovery and exfiltration. Operators go looking for what is worth selling back. At a build-to-order cable maker that could include drawings and specifications, customer part numbers, test and inspection records, quoting and pricing data, supplier terms, NDAs, and HR files. Akira's own post lists personal data, contracts, customer information, financial records and NDAs. That list is a claim, not a finding. 

5. Deployment and impact. Encryption usually targets file servers, databases, virtual machines and backups first, because those are the systems a business cannot easily run without. Operators often delete shadow copies and attack backup repositories before detonating. 

Two points matter for OT readers. First, encrypting IT does not require touching a PLC. If ERP, routing sheets, work orders, lot traceability, or the file server holding process recipes goes down, a plant may stop even though every controller is intact. Researched' Q2 2026 cases, including West Pharmaceutical Services' precautionary global shutdown, show production halting from IT-side loss and precautionary isolation rather than control-system manipulation. Second, a shutdown can be a choice. Companies often power systems down to contain an intrusion they cannot yet scope, which is a sound instinct only if the shutdown itself is planned and safe. 

Why this matters for OT and industrial security leaders 

Calmont's own materials describe extruded shapes, custom design, prototyping and testing, and the company holds aerospace and medical quality certifications. That is a recognizable profile: a small plant where engineering data, process parameters and quality records are the real crown jewels, and where the IT and production sides are likely to share people, accounts and file shares. Calmont's actual network design is not public, so everything below is a general assessment of where suppliers like it are exposed. None of it is a finding about Calmont. 

Engineering workstations and design environments 

Engineering workstations are where drawings, CAD files, specifications, test programs, controller project files and process recipes are created and stored, and they often hold saved credentials and vendor tools. They matter in two ways. Losing access stops new product introduction, changes and troubleshooting. Losing integrity is worse and quieter: a modified drawing, recipe or controller project that reaches the floor can cause scrap, rework or a quality escape without anyone noticing the cause. For a supplier into medical and aerospace programs, tampering with revision-controlled documents is also a traceability problem. 

Practical protections: treat these machines as a separate tier with their own admin accounts and no email or general browsing; allow only approved software (application allowlisting); restrict outbound traffic so a compromised workstation cannot reach file-sharing sites; keep project files and controller backups in offline or immutable copies; move files in and out through a controlled transfer point; and put endpoint detection and logging on them even where agents once seemed risky for OT. 

Segmentation and the IT-to-OT boundary 

Segmentation limits how far an IT compromise can travel. It does not stop ransomware from arriving, and it does not protect the IT side. Its value is that a plant can lose its office network and still run, if the dependencies are understood. The Purdue-style layers below remain a useful vocabulary even for a small plant. 

Three distinctions are worth keeping straight. Network connectivity is whether packets can flow. Authorization is whether an account is allowed to act. Compromise of an OT device is whether an attacker actually changed it. Most ransomware incidents in industrial settings involve the first two and never reach the third, yet still cost production. In ATT&CK for ICS terms, the typical outcomes are loss of availability (T0826), loss of view (T0829) and loss of productivity and revenue (T0828), not manipulation of control. Verify technique IDs against the current ATT&CK for ICS release before citing them. 

Potentially exposed assets at a supplier like this 

These are categories of exposure to assess, not findings. 

Supplier and supply chain consequences 

A specialist cable maker occupies an uncomfortable position: its products are custom, sole-source qualifications are slow, and its customers include robotics builders, medical device makers, sensor and aerospace programs. If a supplier like this loses weeks, the customer feels it as a missed ship date or a requalification question, not as a security story. Other consequences are intellectual property exposure for customers whose specifications sit in the supplier's files, contractual and quality-system obligations around notification and records, and, where a supplier handles controlled defense information, possible regulatory duties. Calmont is registered as a federal contractor, but whether any controlled unclassified information is involved, or whether requirements such as DFARS or CMMC apply to it, is not established by any public source. No Calmont customer has been publicly reported as affected. 

A cyber incident does not imply physical damage, unsafe product or compromised safety systems. In most documented ransomware cases against manufacturers, safety systems and control logic were not the target. The realistic risks are availability, data, and trust. 

Potential damage and business consequences 

The financial and operational impact on Calmont, if any, has not been disclosed and is not publicly established. Nothing below should be read as a loss Calmont has suffered. The table lists the kinds of consequences a ransomware incident can have at a manufacturer, so leaders can size their own exposure. 

Published industry data gives a sense of scale without describing any single victim. One analysis reported by Infosecurity Magazine and summarized by Elisity put downtime costs for manufacturers at about $17 billion across 858 ransomware incidents since 2018, or roughly $1.9 million per day on average. Those are industry-wide averages, driven by large plants, and a small supplier's absolute figures will be far lower while the proportional hit can be as severe. 

Two real cases show the range. In May 2026, per Researched, West Pharmaceutical Services took a precautionary global shutdown after a double-extortion attack, disrupting shipping, receiving and manufacturing across international sites before core systems were restored by May 14. Foxconn's Wisconsin facility reportedly went through roughly two weeks of disrupted production. On the data-leak side, wire and cable maker Southwire filed a federal lawsuit against an anonymous attacker (reported in January 2020) after confidential business information was posted online. Neither is a Calmont fact; they illustrate how production loss and data publication each create their own bills. 

Mitigation and remediation for manufacturers 

If you suspect ransomware: the first hours 

Isolation in an industrial setting has to be coordinated with the people who run the plant. An abrupt disconnection or shutdown can damage product, equipment or safety, so the incident commander and OT operations should decide together. 

1. Declare and escalate. Name an incident commander, open a log, and bring in legal counsel, the cyber insurer and a qualified incident response firm early. Decide who talks to customers and authorities. 

2. Preserve evidence. Capture volatile data and logs before reimaging. Keep firewall, VPN and identity logs, and snapshot affected virtual machines rather than deleting them. 

3. Scope. Identify affected hosts, accounts and remote-access paths. Check for new administrator accounts, unexpected remote-management tools and any virtual machines nobody created, which Huntress documented in an Akira case. 

4. Contain IT first. Isolate compromised IT assets at the switch or EDR level. Disable the remote-access pathways the intruder used, and reset privileged credentials, including service accounts and, if a VPN appliance is implicated, every credential and MFA seed stored on it. 

5. Protect OT availability. Confirm the industrial DMZ and firewall rules are holding. Keep controllers running in a safe state, switch to manual or local operation where procedures allow, and do not reconnect IT to OT until it is verified clean. 

6. Protect backups. Isolate backup servers and repositories before anything else is restored; intruders often go after them first. 

7. Assess exfiltration. Review outbound traffic for archive transfers and file-sharing sites. Treat any actor claim of stolen data as something to test, not accept or dismiss. 

8. Notify as required. Contractual, state and sector obligations differ; counsel decides. 

Preventive controls and their limits 

Segmentation as a containment strategy 

The aim is a plant that can run on its own for a defined period if the office network is lost. In practice that means a firewall-enforced industrial DMZ with no direct sessions from enterprise to control systems; jump servers with MFA and recording for administration; vendor access that is requested, time-limited and logged; no shared domain trust between enterprise and OT where it can be avoided; firewall rules that name specific sources, destinations and protocols; and monitoring of both north-south and east-west traffic in the plant. Segmentation does not prevent ransomware from arriving, and a flat network inside one zone is still a flat network. 

Backup and recovery 

• Keep at least one copy offline or immutable, and one that no domain credential can delete. 

• Back up controller programs, HMI projects, recipes, drawings and engineering software installers, not only servers. 

• Restrict backup console access to dedicated accounts and require MFA. 

• Define recovery time and recovery point objectives per system, and rank restoration order: identity, backup, ERP and engineering data, then supporting services. 

• Test restoration on a schedule, ideally including a rebuild of a server from bare metal. A backup that has never been restored is an assumption, not a recovery strategy. 

Longer-term roadmap 

Not every framework applies to every manufacturer. IEC 62443 and NIST guidance are voluntary for most; NERC CIP applies only to certain electric-sector entities; contractual flow-downs such as those tied to defense work depend on the contract. 

What CISOs and OT security leaders should ask now 

A listing against a supplier is a prompt to test your own assumptions. These twelve questions are a working checklist; any "no" or "not sure" is a finding. 

Executive takeaway for the board. A ransomware group says it has breached a small aerospace and medical cable supplier. The claim is unconfirmed. The lesson does not depend on whether it is true: the greatest realistic risk to our plants is not an attack on controllers but loss of the IT systems, identity services and engineering data that production depends on. We should be able to show that our network can keep running when the office network is lost, and that we can restore from backups we have actually tested. 

Key takeaways 

• Akira's listing of Calmont Wire & Cable is an unverified claim; no public evidence of intrusion, theft, encryption or production impact exists as of November 9, 2026. 

• Akira is a leading threat to manufacturers, ranking second among established groups against industrial organizations in Q2 2026 per Researched. 

• Documented Akira entry points are remote-access devices and valid credentials, and MFA alone has not stopped it where credentials were already stolen. 

• Production loss in industrial ransomware cases has come mostly from losing IT, ERP and virtualization systems, not from direct control-system manipulation. 

• Segmentation, protected engineering data and tested recovery decide how bad an incident becomes. 

Frequently asked questions 

What is the Calmont Wire & Cable ransomware claim? The Akira ransomware group has named Calmont on its leak site and says it will publish 10 GB of corporate data. The claim is unverified, and Calmont has not publicly commented. 

When was Calmont reportedly listed by Akira? Ransomware.live first recorded the listing on November 8, 2026 at 17:33 UTC, with an estimated attack date of November 6. The estimated date is not confirmed. 

What is the Akira ransomware group? Akira is a ransomware-as-a-service operation active since March 2023 that combines data theft and encryption. A joint CISA, FBI, Europol and NCSC-NL advisory reports roughly $244 million in proceeds as of late September 2025. 

Has Calmont Wire & Cable confirmed a ransomware attack? No public confirmation or denial was found as of November 9, 2026. The company is private and no regulatory filing has been identified. 

Is there evidence that Calmont's production network was compromised? No. Nothing public says whether any production, engineering or OT systems were accessed. Industry data shows most ransomware incidents in industrial firms affect IT first. 

What industries does Calmont serve? Its materials list medical, robotics, aerospace, military and sensor applications, among others, and cite ISO 9001, ISO 13485 and AS9100D certifications. 

Why are industrial suppliers attractive ransomware targets? They have low tolerance for downtime, valuable design and customer data, and often smaller security teams. Researched counted 747 manufacturing ransomware incidents in Q2 2026 alone. 

Can ransomware spread from corporate IT into industrial networks? Yes, where the boundary is weak. Shared identity, flat networks, and remote-access paths let an intruder reach plant-adjacent systems; even when controllers are untouched, the loss of IT dependencies can stop production. 

How can manufacturers protect engineering workstations? Treat them as a separate tier: allowlisting, no email or browsing, restricted outbound traffic, dedicated admin accounts, EDR and offline backups of project files. 

How does segmentation help contain industrial ransomware? A firewall-enforced industrial DMZ and zone rules limit which systems an intruder can reach from IT, so a plant can keep running while IT is rebuilt. It reduces blast radius but does not prevent initial infection. 

What should CISOs do after a ransomware claim against a supplier? Check your own exposure to that supplier, review remote-access paths and edge devices, confirm backups, and ask the supplier what they can say. Do not treat the claim as confirmed. 

Which standards help manufacturers strengthen OT security? IEC 62443, NIST SP 800-82 Rev. 3, NIST CSF 2.0, CISA guidance and MITRE ATT&CK for ICS. Applicability varies; NERC CIP covers only certain electric-sector entities. 

Strengthen your industrial cybersecurity posture with Shieldworkz 

If this claim raised questions about your own plant, the practical starting points are asset visibility, a segmentation review, and detection that understands OT traffic. Shieldworkz works with manufacturers and critical infrastructure operators on OT security assessments, network monitoring, threat detection and incident readiness. To talk through how to improve visibility, segmentation and ransomware resilience in your industrial environment, visit shieldworkz.com. 

 Additional resources:

Comprehensive Guide to Network Detection and Response NDR in 2026 here
NERC CIP-015 Internal Network Security Monitoring Readiness Checklist for Electric Utilities here
OT SOC Foundational Guide here
Managed SOC Service here
OT Cyber Threat Intelligence Advisory - Middle East here
NIS2 Directive Achieving NIS2 Compliance Through IEC 62443 here
What Is Removable Media? Risks, Policies, and Industrial OT Security Solutions here
Free Removable Media Policy Template for OT and IT Teams here