Akira ransomware group claims data breach against SMYK

• Ransomware group: Akira
• Country: Poland
• Sector: Retail & E-Commerce
• Announcement date: April 7, 2025

Akira ransomware group claims data breach against SMYK

The Akira ransomware group has listed 28 GB of data allegedly belonging to the retail company SMYK on its leak site. The announcement, which appeared on the group's platform on April 7, 2025, marks a significant potential security incident for the organization, involving a substantial volume of claimed information.

Details of the alleged attack

According to the announcement published by the Akira group on April 7, 2025, the threat actors claim to have successfully accessed the internal systems of SMYK. The group alleges that they have obtained a variety of sensitive information, including corporate documents, financial reports, and personal contact information. No screenshot was provided to support these claims at the time of the announcement.

The threat actors are employing a double-extortion tactic in this incident. In a double-extortion scheme, attackers do not merely encrypt an organization's data to disrupt operations; they also steal sensitive information and threaten to publish it on a public leak site if the ransom demands are not met. This method is designed to exert maximum pressure on the victim organization by leveraging the threat of reputational damage and legal consequences resulting from the public exposure of private data.

Claimed data and affected information

While the specific contents of the breach remain unverified, the Akira group claims to have exfiltrated a wide range of sensitive materials. The alleged data includes various types of corporate and personal information that could be highly sensitive to the organization and its stakeholders. The listed data types include:

• Corporate agreements
• Financial data
• Employee contact information
• Customer contact information

The group's claims suggest that the stolen information encompasses corporate non-disclosure agreements, licenses, agreements, and contracts. Furthermore, the alleged data includes financial data such as audits, payment details, and various reports, alongside contact information for both employees and customers.

About SMYK

SMYK is a Poland-based international retail chain that sells clothing, footwear, toys, and baby accessories for children aged 0-14. The company is known for offering a wide range of products under one roof.

Potential impact and industry implications

If the claims made by the Akira group are verified, the exposure of personal data belonging to SMYK employees and customers could significantly increase the risk of identity theft and targeted phishing attacks for the affected individuals. Such attacks often follow data leaks, as criminals use the stolen contact information to craft convincing fraudulent communications.

Furthermore, the publication of the organization's financial data may lead to negative consequences regarding commercial competition. The exposure of internal financial reports and audit details can provide competitors with insights into the company's strategic position. Additionally, such a breach could potentially trigger data protection investigations under the General Data Protection Regulation (GDPR), as the exposure of personal data is a primary concern for regulatory bodies.

The impact of this incident may vary depending on the sensitivity of the leaked data and the security measures implemented by the organization. It is worth noting that public information regarding the Akira group is limited. In general, organizations in the retail and e-commerce sectors can mitigate such risks by implementing robust security frameworks, ensuring regular backups of critical data, and maintaining strict access controls to sensitive corporate and customer information. Strengthening employee awareness regarding phishing and implementing multi-factor authentication are also standard defensive steps to combat the tactics used by ransomware groups.