Akira ransomware group lists Selenis (Evertis is also involved) on its leak site

• Ransomware group: Akira
• Country: Portugal
• Sector: Manufacturing
• Announcement date: May 8, 2025

Akira ransomware group claims data breach at Selenis and Evertis

The Akira ransomware group has officially listed the manufacturing entities Selenis and Evertis on its dedicated leak site. According to the announcement made on May 8, 2025, the threat actors claim to have successfully compromised a significant volume of corporate information belonging to these organizations. The group has indicated that the stolen data may be published on their platform in the near future, heightening the urgency of the situation for the affected parties.

Details of the claimed attack and data volume

The incident was announced on May 8, 2025, coinciding with the date the group claims the attack took place. The Akira group asserts that they have obtained more than 70 GB of corporate data through their intrusion. While the group has made this claim publicly, no screenshots were provided in the leak site announcement to verify the contents of the stolen files.

The threat actor has identified several specific categories of sensitive information that they claim to have exfiltrated from the organizations. The listed data types include:

• Client personal information
• Passports
• Medical records
• Driver's licenses
• Financial data
• Non-disclosure agreements

The presence of such diverse and sensitive documentation suggests a deep level of access into the corporate environment of the targeted organizations.

About Selenis

Selenis is a multinational company that operates as part of the IMG Group. Since its inception in 1959, the company has been a significant player in the polymers industry. Selenis serves as a specialized supplier, providing innovative copolyesters for a wide variety of industrial and commercial applications.

Implications and potential risks of the breach

This incident poses significant risks, particularly regarding the potential for identity theft involving the clients and employees of the institution. Because the claimed data includes highly sensitive personal identifiers such as passports, driver's licenses, and medical records, the impact extends beyond mere corporate espionage into the realm of individual privacy violations.

From a regulatory perspective, the nature of the data involved may trigger significant obligations under the General Data Protection Regulation (GDPR). The exposure of such information often leads to complex legal landscapes, including potential administrative sanctions for the organization. Furthermore, the Akira group appears to be employing a double extortion tactic. This method involves not only encrypting a victim's systems but also threatening to leak sensitive data to pressure the organization into paying a ransom. Such tactics can lead to severe reputational damage and may even facilitate secondary attacks against the organization or its partners.

In response to such incidents, organizations typically find it necessary to conduct thorough forensic investigations to determine the exact scope and origin of the breach. Identifying the entry point is a critical step in remediation. While specific details regarding this group's methods are limited in the public domain, it is known that they frequently leverage vulnerabilities in Virtual Private Networks (VPNs) to gain initial access to corporate networks. To defend against such threats, organizations in the manufacturing sector often focus on strengthening remote access security, implementing multi-factor authentication, and maintaining rigorous patch management protocols to close known vulnerabilities.