Farmacisti Più Rinaldi S.p.A. targeted by Akira ransomware group

• Ransomware group: Akira
• Country: Italy
• Sector: Healthcare
• Announcement date: June 6, 2025

The Akira ransomware group has listed approximately 15 GB of data allegedly belonging to Farmacisti Più Rinaldi S.p.A. on their leak site. The threat actor has announced their intention to publish the data they claim to have obtained from the organization's systems.

The alleged attack and announcement

The Akira ransomware group added Farmacisti Più Rinaldi S.p.A. to their leak site on June 6, 2025. According to the post made by the group, the attack itself occurred on May 26, 2025. The group has claimed that they have successfully breached the organization's systems and are now holding the data for ransom or threatening its publication.

In many modern ransomware operations, threat actors utilize a method known as double extortion. In this scenario, attackers do not just encrypt an organization's files to disrupt operations; they also exfiltrate sensitive information before the encryption process begins. The threat of leaking this stolen data on a public leak site serves as additional leverage to pressure the victim into paying the ransom. If the victim refuses to comply, the attackers threaten to release the sensitive information to the public, which can lead to significant reputational and legal consequences.

Claimed data and contents

While the threat actor has listed the organization on their site, no screenshot was provided in the post to verify the contents of the stolen data. However, the group claims that the stolen information is substantial and includes various sensitive documents. The threat actor alleges that the data contains several categories of information that could be highly damaging if released.

The data allegedly obtained by the Akira group includes:

• Employee personal data
• Contracts
• Financial data
• Client data
• Non-disclosure agreements

The presence of such diverse data types suggests a deep intrusion into the organization's internal file structures, potentially touching upon human resources, legal, and financial departments.

Organization profile

Farmacisti Più Rinaldi S.p.A. is an Italy-based company that distributes homeopathic products, herbal supplements, veterinary products, medical devices, and sanitary items. The company provides a wide range of products for the pharmaceutical and healthcare sectors.

Potential risks and industry implications

This alleged leak may pose secondary risks such as identity theft or targeted phishing attacks for the organization's employees and clients. Because the stolen data purportedly includes personal employee documents and client information, the individuals involved may be targeted by malicious actors attempting to use their credentials or personal details for fraudulent purposes.

Given that the organization operates in the healthcare sector, the leaked data may contain sensitive information protected under GDPR. The General Data Protection Regulation (GDPR) imposes strict requirements on how organizations handle and protect personal data, particularly sensitive information within the healthcare industry. If the data is indeed published, the organization could face legal sanctions and significant damage to its commercial reputation.

Public information regarding the Akira group indicates that they have been active since early 2023 and often gain network access by exploiting VPN accounts. This highlights a common vulnerability in modern remote-work environments where poorly secured VPN credentials can serve as an entry point for sophisticated ransomware groups.

To mitigate potential legal consequences and security risks, organizations facing such threats may consider reviewing their data security processes and notifying affected parties. Strengthening authentication methods, such as implementing multi-factor authentication, and conducting regular audits of network access points are common defensive steps used to prevent unauthorized entry and limit the impact of a potential breach.