Charm Diamond Centres targeted by Akira ransomware group

• Ransomware group: Akira
• Country: Canada
• Sector: Retail & E-Commerce
• Announcement date: February 16, 2026

Akira ransomware group claims data breach at Charm Diamond Centres

The Akira ransomware group has listed approximately 19 GB of data allegedly belonging to Charm Diamond Centres on their leak site. According to an announcement published on February 16, 2026, the threat actor claims to have obtained corporate data from the organization. The group has stated that they will soon publish a dataset containing sensitive information regarding the company's employees and clients.

The Akira group is recognized as a Ransomware-as-a-Service (RaaS) operation that has been active since early 2023. This type of operation typically involves developers who create the ransomware and affiliates who carry out the actual attacks. The group is known for employing double-extortion tactics, a method where attackers not only encrypt an organization's data but also steal it, threatening to leak the sensitive information publicly if a ransom is not paid. This approach increases the pressure on victims by threatening their reputation and regulatory standing.

Details of the alleged data theft

While no screenshots have been provided to verify the claim, the information provided by the threat actor suggests that a significant amount of sensitive information may have been compromised. The claimed dataset is reported to be 19 GB in size, though the specific file count was not provided in the announcement. The theft allegedly occurred around September 23, 2025.

According to the details shared by the threat actor, the following types of data may have been compromised:

• Employee passport information
• Driver's licenses
• Employee health information
• Financial records
• Client files
• Non-disclosure agreements

The potential exposure of such diverse datasets, ranging from identity documents to financial and health records, represents a significant risk to the individuals involved. When sensitive personal identifiers like passports and driver's licenses are leaked, it significantly increases the risk of identity theft for the affected parties.

Potential impact and regulatory implications

The alleged leak may expose both employees and clients to various risks, particularly regarding identity theft. Because Charm Diamond Centres is based in Canada, the potential data breach may be subject to regulatory scrutiny under the Personal Information Protection and Electronic Documents Act (PIPEDA). Such regulatory oversight ensures that organizations are held accountable for how they protect personal information and how they respond to breaches.

The use of double-extortion methods by Akira suggests that the publication of this data could trigger secondary risks. These include targeted phishing campaigns, where attackers use the stolen information to craft convincing messages to trick individuals, and corporate espionage, where sensitive business information is used to gain a competitive advantage. Furthermore, the organization's operational processes and the trust held by its clients may be negatively impacted by such an event.

Security considerations for the retail sector

While information regarding the specific methods used by the Akira group is limited, it is assessed that they may gain access to networks through the exploitation of VPN vulnerabilities. This highlights a critical area for defensive focus. Organizations in the retail and e-commerce sectors, which often manage vast amounts of customer and employee data, must prioritize robust security measures to defend against such threats.

To mitigate the risks of ransomware and data exfiltration, organizations often implement several defensive layers. This includes maintaining rigorous patch management to close vulnerabilities in remote access tools like VPNs, implementing multi-factor authentication (MFA) across all entry points, and conducting regular network monitoring to detect unauthorized access. Furthermore, robust data encryption and strict access controls can help ensure that even if a perimeter is breached, the data itself remains protected and unusable to unauthorized actors.