Akira ransomware group claims data breach against Ondunova

• Ransomware group: Akira
• Country: Spain
• Sector: Manufacturing
• Announcement date: February 19, 2025

The Akira ransomware group has announced a data leak claim against the manufacturing company Ondunova. According to a post on the group's leak site, the threat actors claim to have stolen a significant amount of corporate information from the organization.

The alleged attack and data claim

The Akira ransomware group has listed 31 GB of data on their leak site, which they claim belongs to Ondunova. According to the group's announcement, the breach occurred following an attack that is reported to have taken place in January 2025. Following the initial intrusion, the group issued a threat to publish the stolen information in February 2025.

While no screenshots of the stolen data have been provided by the attackers to verify their claims, the group asserts that the compromised information includes a variety of sensitive corporate and personal documents. The group claims that the following types of data have been compromised:

• Non-disclosure agreements (NDAs)
• Financial data
• Internal correspondence
• Employee contact information
• Customer contact information

About Ondunova

Grup Ondunova is one of the leading corrugated cardboard packaging manufacturing groups based in Catalonia. Consisting of the companies Ondunova and Wondu, the group carries out its operations at its production centers in Barcelona.

Analysis and potential implications

This incident suggests that sensitive corporate data belonging to Ondunova may have been accessed by unauthorized parties. The alleged compromise of financial data and personal information could lead to secondary risks such as identity theft or targeted phishing attacks against employees and customers. Because the group is known to exploit VPN vulnerabilities, it is possible that weaknesses existed in the company's network security posture.

Given the Akira group's known use of double-extortion tactics, the publication of this data could damage the company's commercial reputation and pose risks to supply chain security. In double-extortion schemes, attackers not only encrypt a victim's systems but also steal sensitive data to use as leverage, threatening to leak it to pressure the organization into paying a ransom.

As the company operates in Spain, this situation may trigger data breach notification requirements and legal sanctions under the GDPR. For organizations operating within the European Union, such incidents necessitate strict adherence to regulatory frameworks regarding the protection of personal data. To mitigate such risks, organizations in the manufacturing sector often focus on strengthening network security, implementing robust access controls, and securing remote access points like VPNs to prevent unauthorized entry into the corporate environment.