Evasa allegedly targeted by frag ransomware group

• Ransomware group: frag
• Country: Spain
• Sector: Professional Services
• Announcement date: June 11, 2025

The threat actor known as frag has listed various documents allegedly belonging to Evasa on their leak site. According to the announcement, the group claims to have obtained data from the company's systems on June 11, 2025. This development follows a pattern often seen in modern cyberattacks where data is exfiltrated and subsequently published on dedicated leak sites to pressure victims.

The claimed attack event

The threat actor known as frag has listed various documents allegedly belonging to Evasa on their leak site. The announcement specifies that the company's financial records and personal documents of employees are included in the leak. The threat actor claims to have obtained this data from the company's systems on June 11, 2025.

In such scenarios, ransomware groups often employ a tactic known as double extortion. This method involves not only encrypting an organization's data to disrupt operations but also stealing sensitive information before the encryption occurs. By threatening to release this information on a public leak site, the attackers aim to maximize their leverage during ransom negotiations. While the specific details of the intrusion method remain unknown, the presence of the listing on a leak site is a hallmark of this extortion strategy.

The data allegedly involved

The announcement specifies that the leak includes various sensitive documents. While no screenshot has been provided to verify the contents of the leak, the group claims that the following types of information have been compromised:

• Financial statements
• Employee passports
• Personal documents
• DNI (Spanish identity card) scans

The disclosure of such specific personal identifiers, such as passport scans and national identity cards, represents a significant escalation in risk for the individuals involved. When highly sensitive identity documents are leaked, the potential for misuse increases significantly.

Organization profile

Evasa is a Spain-based professional services company operating in the field of environmental engineering.

Implications and risk assessment

This incident may indicate that the company's employees could face risks of identity theft. The allegedly leaked DNI and passport data could be utilized for targeted phishing attacks. Furthermore, the disclosure of the company's financial data could pose risks in terms of commercial competition.

Because the company is based in Spain, data breach notification obligations and administrative fines under GDPR may arise. Organizations operating within the European Union must adhere to strict regulatory frameworks regarding the protection of personal data and the timely reporting of breaches to the relevant authorities.

For organizations in the professional services and engineering sectors, maintaining robust defensive postures is critical. Common defensive steps include implementing multi-factor authentication (MFA) across all systems, maintaining regular offline backups, and conducting regular security awareness training to help employees recognize phishing attempts. Additionally, monitoring for unauthorized data exfiltration and ensuring strict access controls can help mitigate the impact of such incidents. Public information about the group responsible for this claim is currently limited.