Galfer allegedly targeted by Akira ransomware group in data leak

• Ransomware group: Akira
• Country: Spain
• Sector: Manufacturing
• Announcement date: January 9, 2025

Akira ransomware group claims data leak of Galfer

The Akira ransomware group has announced a data leak involving the Spanish manufacturing company Galfer. According to an announcement made on a leak site on January 9, 2025, the threat actors claim to have exfiltrated a significant volume of sensitive information. The group alleges that the breach occurred around December 5, 2024, and involves a data set totaling approximately 65 GB.

Ransomware attacks often follow a pattern where threat actors gain unauthorized access to a network and proceed to steal sensitive information before deploying encryption. This specific incident involves a claim of data exfiltration, which is a common tactic used to pressure organizations into paying a ransom.

Details of the alleged data breach

The Akira ransomware group has stated that the stolen data consists of various private corporate documents. While no screenshots were provided to verify the contents of the leak, the group claims the information is highly sensitive and pertains to the internal operations of the company. The threat actor's post identifies the victim as a manufacturer of braking systems and friction materials.

The leaked data is said to include several categories of sensitive information, specifically targeting both corporate and personal details. The items listed in the claim include:

• Non-disclosure agreements (NDAs)
• Employee contact details
• Customer contact details
• Employee DNI numbers
• HR records

The presence of such diverse data types suggests a broad compromise of internal systems, ranging from human resources to client management and legal departments.

About Galfer

Galfer is a Spanish-based company that operates within the manufacturing sector. The firm specializes in the production of high-performance brake components, specifically focusing on braking systems and friction materials. Since its founding in 1952, Galfer has established itself as a provider for the automotive, motorcycle, and bicycle industries.

Potential impact and security implications

The alleged leak of this data carries significant risks for the affected organization and its stakeholders. For the employees and customers whose personal information was reportedly stolen, there is an increased risk of identity theft and targeted phishing attacks. Such attacks often leverage stolen contact details and identification numbers to conduct social engineering or financial fraud.

Because Galfer is based in Spain, the exposure of personal data may fall under the regulatory scope of the European Union's General Data Protection Regulation (GDPR). Furthermore, the group's use of the double extortion method—whereby data is both encrypted and stolen to increase leverage—can severely impact a company's operational continuity and its overall reputation. There is also the possibility that this incident could create secondary risks for the company's various supply chain partners.

Regarding the threat actor, information about the Akira group remains limited. However, they are known to frequently exploit vulnerabilities in Virtual Private Networks (VPNs) to gain initial access to corporate networks. To defend against such threats, organizations in the manufacturing sector often focus on securing remote access points, implementing multi-factor authentication, and maintaining rigorous patch management schedules to close known vulnerabilities.