Docurail listed on radiant leak site following claims of a data breach

• Ransomware group: radiant
• Country: Finland
• Sector: Transportation
• Announcement date: October 16, 2025

A new target in the transportation sector

The threat actor known as radiant has listed the organization Docurail on its leak site, marking a new incident involving a company within the transportation sector. On October 16, 2025, the group announced that it had targeted the organization, claiming that it successfully gained access to the company's digital systems. This announcement follows a pattern often seen in modern cyberattacks, where threat actors use leak sites to pressure victims by threatening to release sensitive information.

In such scenarios, ransomware groups often employ a strategy known as double extortion. In this method, attackers do not merely encrypt a company's data to disrupt operations; they also exfiltrate sensitive information to use as leverage. By threatening to publish this data on a public leak site, the attackers aim to create reputational damage and legal pressure, forcing the victim to comply with their demands to prevent the public disclosure of proprietary or personal information.

Details of the alleged breach

According to the announcement made by radiant on October 16, 2025, the group claims to have achieved unauthorized access to the digital infrastructure of Docurail. While the group has officially listed the organization on its platform, specific details regarding the nature of the breach remain limited. Information regarding the specific methods used by the group to infiltrate the network is currently unavailable, and public information concerning the capabilities and identity of the radiant group remains restricted.

Regarding the content of the alleged leak, the announcement provided no specific details or screenshots to substantiate the claim. The listing does not specify the types of data that have been compromised, nor does it provide information regarding the volume of files or the total size of the data allegedly stolen. Consequently, the listing names no specific data types.

About Docurail

Docurail is a technology company based in Finland that operates within the transportation sector. The firm specializes in digitizing compliance processes for the railway industry, aiming to transform complex paperwork into manageable digital workflows. By focusing on these digital transformations, the company seeks to increase efficiency and ensure regulatory compliance within railway operations.

Potential risks and organizational implications

The listing of an organization on a ransomware leak site suggests that its digital assets and trade secrets may be at risk. If the claims made by the threat actor are confirmed, the organization could face significant legal and regulatory consequences. Specifically, under the European Union's General Data Protection Regulation (GDPR), such breaches can lead to formal legal proceedings and administrative sanctions.

Beyond the immediate regulatory risks, the organization faces several secondary threats. These include the potential for identity theft and the emergence of targeted phishing attacks aimed at the organization's clients and business partners. Furthermore, a confirmed breach can negatively impact the organization's reliability within the supply chain and may cause significant disruptions to its operational continuity.

To mitigate such risks, organizations in highly regulated sectors often implement defensive strategies such as multi-factor authentication, regular security audits, and robust data encryption. Maintaining a strong security posture is essential for protecting the integrity of the supply chain and ensuring that digital workflows remain secure against unauthorized access.