Anfarm Hellas listed on Akira ransomware leak site

• Ransomware group: Akira
• Country: Greece
• Sector: Healthcare
• Announcement date: April 16, 2025

Akira ransomware group claims data breach at Anfarm Hellas

The pharmaceutical manufacturer Anfarm Hellas has been listed on the leak site associated with the Akira ransomware group. According to the announcement made on April 16, 2025, the group claims to have successfully targeted the organization, alleging that they have acquired a significant volume of corporate information.

The Akira group, which has been active since early 2023, claims to be in possession of over 35 GB of corporate documents belonging to the company. This claim was posted on their dedicated leak site on the same day the attack was allegedly carried out. Akira is known for employing double-extortion tactics, a method where attackers not only encrypt an organization's systems but also steal sensitive data to threaten its public release unless a ransom is paid.

Details of the alleged data theft

While the group has not provided any screenshots to verify their claims, the announcement specifies several categories of sensitive information that have supposedly been compromised. The data allegedly stolen from Anfarm Hellas includes a variety of internal and external records that could impact various stakeholders of the company.

The information reportedly includes:

• Employee personal data
• Financial data
• Client data
• Contact information

The specific financial data mentioned in the claim encompasses audits, payment details, and various reports. Additionally, the group claims to have obtained corporate non-disclosure agreements (NDAs) and contact information belonging to government officials. No information was provided regarding the specific ransom demand or the exact file count involved in this incident.

About Anfarm Hellas

Anfarm Hellas is a Greece-based pharmaceutical company that specializes in the manufacturing of generic pharmaceutical formulations intended for human use. The organization maintains a significant international presence, selling its products to 31 different countries. Furthermore, the company provides specialized contract manufacturing services to a client base consisting of 45 different entities.

Potential impact and security implications

This alleged leak carries several significant risks for the organization and its stakeholders. For the employees and clients of Anfarm Hellas, the exposure of personal and contact information may increase the risk of identity theft or the occurrence of targeted phishing campaigns. For the company itself, the exposure of sensitive financial data, such as audits and payment details, could lead to a loss of commercial reputation and a reduction in competitive advantage.

Because Anfarm Hellas operates within the European Union, this incident may trigger legal processes regarding data protection breaches under the General Data Protection Regulation (GDPR). The use of double-extortion tactics by the Akira group introduces the possibility that the leaked data could be utilized in secondary attacks or that additional datasets might be released if a ransom is not met.

In such scenarios, organizations typically focus on incident response and forensic investigations to determine the scope of the breach. Common defensive steps for organizations in the healthcare and pharmaceutical sectors include implementing robust network segmentation, maintaining rigorous backup protocols, and enhancing employee training to recognize social engineering attempts. Monitoring for unauthorized data exfiltration and ensuring compliance with regional data protection laws are also critical components of a modern cybersecurity posture.