GPS 909 listed on Akira ransomware leak site

• Ransomware group: Akira
• Country: Spain
• Sector: Professional Services
• Announcement date: March 10, 2025

Akira ransomware group claims breach of GPS 909

The Akira ransomware group has officially listed the Spanish security firm GPS 909 on its dedicated leak site. According to the announcement, the threat actors claim to have successfully infiltrated the organization's systems, leading to a significant data breach. This development follows an alleged attack date of March 7, 2025, with the public announcement appearing on the group's leak site on March 10, 2025.

The group's actions appear to follow a classic double extortion strategy. In such scenarios, ransomware actors do not merely encrypt an organization's data to disrupt operations; they also exfiltrate sensitive information to use as leverage. By threatening to publish stolen data on public forums or leak sites, the attackers aim to pressure the victim into paying a ransom to prevent the exposure of confidential information, which can lead to severe regulatory and reputational consequences.

Details of the alleged data theft

While the threat actors have claimed responsibility for the breach, no screenshots have been provided to verify the contents of the shared data. The Akira group alleges that they have acquired various corporate documents and sensitive information through their unauthorized access to the institution's systems. The specific types of data claimed to have been leaked include:

• Employee contact information
• Customer contact information
• Personal NIF numbers
• Financial data
• Internal correspondence

The presence of personal identification numbers (NIF) and contact details suggests that the breach extends beyond internal corporate files to include private information belonging to both staff and clients. The group's claim regarding the acquisition of financial reports and internal correspondence further highlights the potential impact on the organization's private operations.

About GPS 909

Grupo de Protección y Seguridad 909 is a pioneering security company specialized in all types of protection and surveillance systems on the island of Ibiza. They operate with a multidisciplinary team to provide various security services within their region of operation.

Potential impacts and security implications

The alleged leak of this information poses significant secondary risks. For the employees and customers of GPS 909, the exposure of contact details and personal NIF numbers could facilitate identity theft and highly targeted phishing attacks. Such attacks often use stolen personal information to gain trust and manipulate victims into revealing further credentials or financial assets.

Because the organization operates in Spain, this incident may trigger specific legal obligations regarding the protection of personal data under the General Data Protection Regulation (GDPR). Furthermore, the exposure of financial data, as claimed by the Akira group, could lead to substantial commercial damage and a loss of corporate reputation. The group's known tendency to exploit VPN accounts suggests that the institution's network security processes may require a thorough review to mitigate such vulnerabilities.

For organizations in the professional services and security sectors, this incident underscores the critical importance of maintaining robust network security and monitoring access points. Strengthening authentication protocols and implementing strict data protection measures are essential to maintain operational continuity and protect against the multifaceted threats posed by modern ransomware groups.