Globatech listed on Akira ransomware leak site

• Ransomware group: Akira
• Country: Canada
• Sector: Professional Services
• Announcement date: November 26, 2025

Akira ransomware group claims data breach at Globatech

The Akira ransomware group has officially listed the Canadian professional services organization Globatech on its dedicated leak site. According to the announcement made on November 26, 2025, the threat actor group claims to have targeted the company following a cyber incident that allegedly occurred on November 7, 2025. The group has asserted its intention to publish a significant volume of stolen corporate information if their demands are not met.

This incident follows the pattern of double extortion, a common tactic used by modern ransomware groups. In a double extortion scheme, attackers do not merely encrypt an organization's systems to disrupt operations; they also exfiltrate sensitive data. The group then threatens to leak this stolen information on public forums or specialized leak sites to pressure the victim into paying a ransom. This method significantly increases the pressure on an organization, as the threat of public exposure can cause lasting damage to reputation and legal standing, even if the company can restore its systems from backups.

Details of the alleged data theft

The Akira group claims to have acquired approximately 25 GB of data allegedly belonging to Globatech. While no screenshots were provided in the leak site post to verify the contents, the group asserts that the stolen information is highly sensitive and covers various aspects of the company's operations across Canada. The group claims to have gained access to a wide array of internal documentation through their intrusion.

According to the group's announcement, the stolen data is said to include the following types of information:

• Employee information
• Client information
• Financial data
• Accounting data
• Agreements
• Non-disclosure agreements

The presence of such diverse data types suggests a deep level of access into the organization's internal file structures and administrative processes.

Organization profile: Globatech

Globatech is a group of six companies providing 24/7 service throughout Quebec and across Canada. The organization focuses on ensuring the health and safety of buildings through its various service offerings.

Potential risks and implications of the leak

The alleged exposure of this data poses several significant risks to Globatech and its stakeholders. For employees and clients, the theft of personal and contact information creates secondary risks, such as the potential for identity theft and the likelihood of highly targeted phishing attacks. When attackers possess specific details about an individual's professional role or financial standing, they can craft much more convincing social engineering campaigns.

From a regulatory and legal perspective, the exposure of corporate and personal data may trigger legal proceedings regarding data privacy obligations under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA). Organizations are required to protect the privacy of the personal information they collect, and a breach of this magnitude often necessitates formal investigations and notifications to regulatory bodies.

Furthermore, the Akira group is known for exploiting vulnerabilities in Virtual Private Networks (VPNs) to gain initial network access. This suggests that the breach may have originated from vulnerabilities within the company's existing cybersecurity infrastructure. The sensitivity of the alleged data also creates indirect risks for the company's supply chain partners, who may be affected by the potential compromise of shared project details or contractual agreements.

To defend against such threats, organizations in the professional services sector should prioritize robust security measures. This includes implementing multi-factor authentication (MFA) on all remote access points, such as VPNs, and conducting regular vulnerability assessments to identify and patch weaknesses before they can be exploited. Additionally, maintaining strict data minimization practices and ensuring comprehensive encryption for data at rest and in transit can help mitigate the impact of a potential exfiltration event.