Akira ransomware group claims data breach against FELA (EVYTRA)

• Ransomware group: Akira
• Country: Switzerland
• Sector: Manufacturing
• Announcement date: November 20, 2025

Akira ransomware group targets FELA (EVYTRA)

The Akira ransomware group has officially listed the Swiss organization FELA (EVYTRA) on its dedicated leak site. According to the announcement made on November 20, 2025, the threat actor group claims to have successfully exfiltrated a significant amount of corporate information. The group asserts that they are in possession of 91 GB of data belonging to the company, which they intend to release in the near future.

This incident follows a common pattern observed in modern cyberattacks where threat actors utilize leak sites to pressure victims. In such scenarios, the group typically announces the breach to create public visibility and pressure the targeted organization into meeting their demands. While the group has made these claims, the breach has not been independently verified.

Details of the alleged data exfiltration

The announcement published by the Akira group suggests that the compromised information is deeply integrated with the company's core business operations. Specifically, the group claims that the stolen data includes various documents related to the firm's specialized activities in the manufacturing of electronic solutions and printed circuit boards. The group has indicated that the full 91 GB of data is expected to be made public soon.

According to the claims made by the attackers, the stolen dataset is quite diverse and contains sensitive information spanning multiple categories. The listed data types include:

• Employee identity cards
• Passport information
• Driver license information
• Contact information
• Financial records
• Accounting documents
• Client files
• Contracts
• Non-disclosure agreements (NDA)

It is important to note that the group has not provided any screenshots to substantiate these claims at the time of the announcement.

About FELA (EVYTRA)

FELA (EVYTRA) is an organization based in Switzerland. The company specializes in the development and manufacturing of innovative electronic solutions. Their technical expertise includes the production of Human Machine Interfaces (HMIs) and printed circuit boards (PCBs), which are critical components in various industrial and electronic applications.

Potential impact and security implications

If the claims made by the Akira group are verified, the exposure of this specific dataset could lead to several significant consequences. The inclusion of highly sensitive personal identifiers, such as passports and driver licenses, significantly increases the risk of identity theft for the affected employees. Furthermore, the potential release of corporate financial records, accounting documents, and client files could result in a loss of competitive advantage and damage the trust established with clients.

From a regulatory perspective, since the company is headquartered in Switzerland, such a breach could trigger legal sanctions under the Swiss Federal Act on Data Protection (FADP) and the General Data Protection Regulation (GDPR). The threat actor's use of a double-extortion methodology—where data is both encrypted and stolen—means that the threat of leaking this information can be used to facilitate secondary attacks or highly targeted phishing campaigns against the company and its partners.

In general, organizations in the manufacturing and electronics sectors often face risks related to the theft of intellectual property and sensitive commercial contracts. To defend against such threats, industry experts typically recommend implementing robust data loss prevention (DLP) strategies, enforcing strict access controls, and maintaining rigorous monitoring of network traffic to detect unauthorized data transfers. Additionally, regular security awareness training is essential to mitigate the risk of phishing, which often serves as an initial entry point for ransomware deployment.