Icat Food SpA listed on Akira ransomware leak site

• Ransomware group: Akira
• Country: Italy
• Sector: Agriculture and Food Production
• Announcement date: February 16, 2026

Icat Food SpA targeted by Akira ransomware group

The Akira ransomware group has listed the Italian organization Icat Food SpA on its dedicated leak site. According to the announcement made on February 16, 2026, the threat actors claim to have successfully compromised the company's network, resulting in the theft of a significant volume of corporate information.

The group asserts that the breach occurred around January 21, 2026. While the specific details regarding the ransom demand were not provided in the announcement, the threat actors have claimed to have obtained approximately 12 GB of data. The group has indicated that this stolen information is slated for publication in the near future.

Details of the alleged data theft

The Akira ransomware group, which has been active as a Ransomware-as-a-Service (RaaS) entity since early 2023, is known for employing double extortion tactics. In such scenarios, attackers not only encrypt an organization's systems to disrupt operations but also steal sensitive data to use as leverage, threatening to leak it publicly if a ransom is not paid.

According to the claims made by the threat actors, the stolen data includes a variety of sensitive files and personal identifiers. Although no screenshots were provided to verify the contents of the stolen data, the group claims the following information was compromised:

• Employee passport information
• Driver's licenses
• Personal data
• Financial records
• Customer information
• Project files

Implications and potential risks

This alleged breach presents several significant risks to both the organization and the individuals whose data was targeted. The exposure of sensitive documents such as passports and driver's licenses poses a high risk of identity theft for employees and customers. Furthermore, the theft of financial and customer records can lead to highly targeted phishing campaigns, where attackers use the stolen information to gain further trust during social engineering attempts.

Because Icat Food SpA is based in Italy, the compromise of personal data may fall under the regulatory scope of the EU General Data Protection Regulation (GDPR). This could result in intense regulatory scrutiny and potential legal consequences for the organization. Additionally, the use of double extortion tactics by the Akira group can cause substantial damage to a company's commercial reputation and its ability to maintain operational continuity if the data is released to the public.

In terms of defensive posture, the Akira group has shown a tendency to exploit vulnerabilities in Virtual Private Networks (VPNs) to gain initial access to networks. This highlights the critical importance for organizations to continuously re-evaluate and strengthen their network security protocols. To mitigate such risks, organizations often implement multi-factor authentication, conduct regular vulnerability assessments, and ensure that all remote access points are strictly monitored and patched against known exploits.