Benuta listed on Akira ransomware leak site

• Ransomware group: Akira
• Country: Germany
• Sector: Retail & E-Commerce
• Announcement date: January 30, 2025

Akira group claims data breach at Benuta

The Akira ransomware group has claimed to have leaked data belonging to the retail and e-commerce company Benuta. According to an announcement made on the group's leak site on January 30, 2025, the threat actors allege that they have successfully compromised various corporate documents belonging to the organization.

The group claims to have gained unauthorized access to the organization's internal correspondence and sensitive information. This allegation suggests that a significant cybersecurity incident may have occurred within the organization's digital infrastructure. While the group has listed the company on its leak site, no screenshots were provided to support the claims at the time of the announcement.

Details of the alleged data leak

The announcement made by the Akira group specifies a wide range of sensitive information that has allegedly been compromised. The group claims to have obtained access to various internal and external documents that could impact the company's operations and the privacy of its stakeholders. The specific types of data mentioned in the claim include:

• Non-disclosure agreements (NDAs)
• Employee contact information
• Customer contact information
• Financial data (audits, payment details, reports)
• Contracts
• Internal correspondence
• HR documents

The breadth of this alleged data theft suggests a deep penetration into the company's administrative and financial records. It is important to note that the group has not provided specific details regarding the total size of the data stolen or the exact number of files involved in the breach.

About Benuta

Benuta is one of Europe's leading online retailers for carpets and home textiles. The company provides direct-to-consumer e-commerce services with a wide range of products, serving a broad customer base through its digital platforms.

Impact assessment and industry implications

This incident may result in the exposure of personal data belonging to Benuta's employees and customers. The leaked financial data and contracts could create secondary risks for the organization's business operations and potentially lead to strategic vulnerabilities. Because the organization is based in Germany, the incident may trigger data breach notification requirements under the General Data Protection Regulation (GDPR).

Given the Akira group's known use of double-extortion tactics, the publication of this data could facilitate identity theft or targeted phishing attacks against the affected individuals. Double extortion is a common ransomware tactic where attackers not only encrypt an organization's data but also steal it, threatening to leak it publicly unless a ransom is paid. This adds a layer of pressure on the victim, as the threat of data exposure remains even if systems are restored from backups.

For organizations operating in the retail and e-commerce sectors, such incidents highlight the critical importance of robust cybersecurity defenses. Protecting sensitive customer and employee information is vital for maintaining trust and complying with strict regulatory frameworks. Organizations in this sector often focus on implementing multi-factor authentication, maintaining rigorous patch management, and conducting regular security audits to mitigate the risk of unauthorized access to internal correspondence and financial records. Furthermore, having a clear incident response plan is essential for managing the legal and operational consequences of a potential data breach.