Akira ransomware group lists Selenis (Evertis) on its leak site

• Ransomware group: Akira
• Country: Portugal
• Sector: Manufacturing
• Announcement date: May 8, 2025

Akira ransomware group claims data breach against Selenis

The Akira ransomware group has announced a significant data leak involving the Portuguese manufacturing firm Selenis (Evertis). According to an announcement made on a leak site on May 8, 2025, the threat actor group claims to have exfiltrated a substantial volume of sensitive information from the organization's network.

The group asserts that the breach occurred following a cyberattack that allegedly took place on April 22, 2025. Following the initial intrusion, the Akira group claims to have seized approximately 70 GB of data from the organization's infrastructure. To ensure the widest possible distribution of the stolen information, the group has made the files accessible to the public via a torrent link. This method of distribution is common among modern ransomware operations, as it allows for decentralized and persistent access to the stolen datasets.

The Akira group is recognized in the cybersecurity community as a ransomware-as-a-service (RaaS) entity. Having been active since early 2023, the group is known for employing double-extortion tactics. In a double-extortion scenario, attackers do not merely encrypt an organization's systems to disrupt operations; they also steal sensitive data and threaten to publish it on public leak sites if a ransom is not paid. This approach increases the pressure on the victim by threatening their reputation and legal standing through the exposure of private information.

Details of the allegedly leaked data

While the group has not provided any screenshots to verify the contents of the stolen files, the post shared on the leak site provides a detailed list of the types of information allegedly compromised. The data, which was reportedly seized from the organization's internal network, is said to include a wide variety of highly sensitive documents and personal identifiers.

According to the claims made by the Akira group, the affected data types include:

• Client personal data
• Passport information
• Medical records
• Driver's licenses
• Financial data
• Non-disclosure agreements

The inclusion of such diverse data types—ranging from government-issued identification to confidential legal and financial documents—suggests a deep level of access into the organization's digital environment.

Selenis organization profile

Selenis is a company operating under the IMG Group, with a presence in the polymers industry since 1959. It is a global supplier that produces innovative copolyesters for a diverse range of applications.

Potential risks and industry implications

The nature of the allegedly leaked data poses significant secondary risks to both the organization and the individuals whose information was stolen. The exposure of passports, driver's licenses, and medical records creates a high risk for identity theft and targeted phishing attacks directed at the organization's employees and clients. Such attacks often leverage the stolen personal details to build trust with the victim, making the fraudulent communications appear legitimate.

Furthermore, because the organization is based in Portugal, this breach may trigger significant legal and regulatory consequences. The exposure of personal and sensitive data under these circumstances may lead to legal sanctions and administrative processes under the European Union's General Data Protection Regulation (GDPR). Organizations operating within the EU must adhere to strict protocols regarding the protection and handling of personal data to avoid such outcomes.

From a technical perspective, the Akira group has demonstrated a tendency to exploit VPN accounts to gain initial access to networks. This suggests that the organization's network security processes may have contained vulnerabilities that allowed the attackers to penetrate the perimeter. The use of a public torrent network for data distribution further complicates the situation, as it can cause the impact of the leak to spread to a wider audience more rapidly.

In the manufacturing sector, where supply chains are often complex and interconnected, such breaches can have cascading effects. Organizations in this sector can take defensive steps by implementing robust multi-factor authentication (MFA) on all remote access points, such as VPNs, to mitigate the risk of credential exploitation. Additionally, maintaining strict network segmentation and conducting regular audits of access logs can help detect unauthorized movement within a network before significant data exfiltration occurs.