D'Granel allegedly targeted by Akira ransomware group

• Ransomware group: Akira
• Country: Brazil
• Sector: Transportation
• Announcement date: April 16, 2025

Akira ransomware group claims data breach at D'Granel

The Akira ransomware group has listed a significant amount of data on its leak site, claiming the information belongs to the Brazilian transportation company D'Granel. According to the announcement made on April 16, 2025, the threat actor group alleges they have successfully exfiltrated 40 GB of data from the organization. This claim follows a pattern of activity often seen in modern cyberattacks where groups use public leak sites to pressure organizations into meeting their demands.

The incident appears to be linked to the company's logistics and fleet management operations. While the group has posted the information on their platform, no screenshots were provided to verify the contents of the alleged leak. This type of announcement is a common tactic used by ransomware groups to demonstrate the success of their intrusion and to increase the pressure on the victim organization.

Details of the alleged data theft

The Akira group asserts that the stolen data is highly sensitive and contains a variety of corporate and personal information. According to the group's claims, the breach involves several categories of data that could impact the company's internal operations and its relationships with external parties. The group claims to possess the following types of information:

• Financial data
• Corporate NDAs
• Employee contact information
• Customer contact information

The breach, as described by the group, includes financial audits, payment details, various reports, and corporate non-disclosure agreements (NDAs). Additionally, the group claims to have access to contact information for both employees and customers, which significantly increases the potential for secondary exploitation.

About D'Granel

D'Granel is a Brazil-based transportation company. The organization provides a range of services within the logistics sector, including logistics, fleet management, and cargo transportation services. Given the nature of their operations, the company manages complex supply chain data and significant amounts of client and personnel information.

Impact and security implications

This incident may negatively impact the company's operational continuity and reputation. The publication of leaked personal information could potentially lead to identity theft or targeted phishing attacks against employees and customers. Furthermore, given the LGPD regulations in Brazil, the company may face administrative sanctions regarding its data protection obligations.

Considering the Akira group's double-extortion method, the publication of this data could increase secondary risks. Double extortion is a technique where attackers not only encrypt a victim's data but also steal it, threatening to leak it publicly unless a ransom is paid. This method is designed to maximize leverage over the target. While public information about the Akira group is limited, they are known to often exploit VPN vulnerabilities in similar attacks.

In general, organizations in the transportation and logistics sectors can take several defensive steps to mitigate such risks. Implementing multi-factor authentication (MFA) across all remote access points, particularly VPNs, is a critical defense. Additionally, maintaining strict network segmentation can help prevent attackers from moving laterally through the network to reach sensitive financial or customer databases. Regular security audits and robust data encryption protocols for both at-rest and in-transit data are also essential components of a modern cybersecurity posture.