Akira ransomware group claims data breach against Druni

• Ransomware group: Akira
• Country: Spain
• Sector: Retail & E-Commerce
• Announcement date: July 29, 2025

Akira ransomware group claims data breach against Druni

A ransomware leak announcement has been published regarding the data of the retail and e-commerce company Druni. The threat group known as Akira has listed approximately 40 GB of corporate data, which they claim belongs to Druni, on their leak site. This announcement was made on July 29, 2025, following a claimed attack date of July 23, 2025.

Details of the alleged data leak

The threat actors are employing a double extortion tactic by threatening to publish this information. Double extortion is a common ransomware strategy where attackers not only encrypt a victim's systems to disrupt operations but also exfiltrate sensitive data. The attackers then threaten to leak this stolen information on public forums or dedicated leak sites if the ransom demand is not met, thereby increasing the pressure on the organization.

No screenshot is available to verify the claims. According to the claims made by the Akira group, the leaked data includes a wide variety of sensitive corporate and personal information. The specific types of data mentioned in the listing include:

• Employee identification documents (DNI)
• Financial records
• Project data
• Customer information
• Contracts and agreements

Furthermore, the claims suggest that the stolen documentation includes contracts with major brands such as L'oreal, Dior, and Chanel.

Organization profile

Druni is a Spain-based retail chain and e-commerce platform specializing in perfumes, cosmetics, and personal care products.

Risk assessment and implications

This alleged leak indicates that Druni's employees and customers may face risks of identity theft due to the nature of the sensitive information involved. The inclusion of third-party contracts among the alleged data could create secondary risks for supply chain security, as the exposure of agreements with major partners can impact business relationships and operational integrity.

Given the GDPR regulations applicable within the European Union, the company may face legal sanctions due to a potential personal data breach. Organizations operating within the EU must adhere to strict data protection standards, and failures in securing personal information can result in significant regulatory consequences. Additionally, considering the known double extortion tactics of the Akira group, it is possible that the leaked information could be utilized for targeted phishing attacks. In such scenarios, attackers use stolen details to craft highly convincing messages to deceive employees or customers.

In response to such incidents, organizations are typically required to fulfill data breach notification obligations and inform the affected parties. General defensive steps for organizations in the retail and e-commerce sectors often include implementing robust multi-factor authentication, maintaining rigorous patch management schedules, and conducting regular security awareness training to defend against the phishing attempts that often follow a data leak.