Arcusin listed on Akira ransomware leak site

• Ransomware group: Akira
• Country: Spain
• Sector: Agriculture and Food Production
• Announcement date: March 10, 2025

Arcusin targeted by Akira ransomware group

The Spanish company Arcusin has been listed on a ransomware leak site by the Akira group. The threat actors claim to have successfully exfiltrated a significant volume of corporate information, specifically alleging the theft of 55 GB of data belonging to the organization.

This incident, announced on March 10, 2025, follows a pattern of behavior observed in modern cyber extortion campaigns. Ransomware leak sites serve as public platforms where threat actors post information about their victims to pressure them into paying ransoms. When a group utilizes a leak site in this manner, it is often a component of a double extortion strategy. In such scenarios, attackers do not merely encrypt a victim's systems to disrupt operations; they also steal sensitive data to threaten its public release, thereby increasing the pressure on the target to comply with financial demands.

Details of the alleged data breach

According to the announcement made by the Akira group, the stolen information is related to the operational processes of Arcusin. While the group has not provided any screenshots to verify the authenticity of the stolen files, they claim the breach includes a wide variety of sensitive documents. The alleged data includes:

• Non-disclosure agreements
• Licenses
• Agreements
• Internal correspondence
• Passports
• Employee records
• Customer documents

The presence of such diverse data types—ranging from high-level corporate contracts to highly sensitive personal identification documents like passports—suggests a deep intrusion into the company's internal file structures. It is important to note that the group has not specified a ransom demand or provided further details regarding the exact nature of the breach beyond these claims.

About Arcusin

Arcusin is a Spanish company that operates within the agriculture and food production sector. The organization specializes in the development and manufacture of specialized bale handling equipment. Their primary objective is to provide technological solutions that increase efficiency and facilitate cost savings for farmers through advanced machinery.

Risk assessment and implications

The Akira group has been active since early 2023 and is known for leveraging vulnerabilities in VPNs to gain unauthorized access to corporate networks. The alleged breach of Arcusin carries several significant risks. For the employees and customers whose personal data may have been compromised, the theft of documents such as passports and employee records poses a high risk of identity theft and targeted phishing attacks.

Furthermore, because Arcusin is located in Spain, the potential exposure of personal data may trigger legal obligations and sanctions under the General Data Protection Regulation (GDPR). Such regulations require organizations to notify authorities and affected individuals when personal data is compromised. Beyond regulatory concerns, the disclosure of trade secrets, internal correspondence, and corporate contracts could severely damage the company's competitive standing and weaken the security of its supply chain.

In general, organizations facing such threats should focus on robust defensive measures. This includes securing remote access points, such as VPNs, through multi-factor authentication and regular vulnerability patching. Implementing strict data loss prevention (DLP) strategies and ensuring comprehensive encryption for data at rest and in transit can also mitigate the impact of an exfiltration event. Given the double extortion tactics used by groups like Akira, the risk of data being made public remains high if the attackers' demands are not met.