Kraken ransomware group lists www.sanmarti.es on its leak site

• Ransomware group: Kraken
• Country: Spain
• Sector: Transportation
• Announcement date: June 28, 2025

Kraken ransomware group claims attack on Transportes Sanmarti SA

The threat actor known as Kraken has announced the listing of Transportes Sanmarti SA on its dedicated leak site. According to an announcement made by the group, an action has been carried out against the digital assets of the organization. The group alleges that it has successfully obtained the institution's data and has subsequently shared this information publicly.

This type of announcement is a common tactic used by ransomware groups to pressure victims. By listing an organization on a leak site, the threat actors aim to create public visibility around the breach, often as a precursor to or a component of extortion efforts. In such scenarios, the group typically claims to have exfiltrated sensitive information and threatens to release it unless specific demands are met.

Details of the alleged incident

The Kraken group published its announcement on June 28, 2025, claiming that the attack took place around April 3, 2025. While the group has officially added Transportes Sanmarti SA to its target list, the specific details surrounding the breach remain limited. The group's post asserts that the institution's digital assets were compromised and that the stolen data has been made public.

Regarding the specifics of the breach, there is no information regarding the nature of the alleged leaked data in the announcement or the screenshot provided. The listing does not specify the volume of data involved or the specific types of files that were purportedly accessed by the attackers.

About Transportes Sanmarti SA

Transportes Sanmarti SA is a logistics and road transport company based in Spain. The company provides freight transport and distribution services for various industries, playing a role in the regional supply chain through its logistics and road transport operations.

Risk assessment and industry implications

This incident indicates that corporate data belonging to Transportes Sanmarti SA may be at risk of exposure. As the institution operates in Spain, any confirmed data breach could lead to legal sanctions and compliance obligations under GDPR. The publication of such data may create risks of identity theft or targeted phishing attacks for employees and business partners.

The potential use of double-extortion tactics may negatively impact the institution's operational continuity. Double extortion is a method where attackers not only encrypt an organization's data to disrupt operations but also steal sensitive information to threaten its public release. This approach increases the pressure on the victim, as even if systems are restored from backups, the threat of data exposure remains.

Information regarding the Kraken group is limited; therefore, the group's methods and motivations remain uncertain. For organizations operating in the transportation and logistics sector, such incidents highlight the importance of robust cybersecurity frameworks. Common defensive steps for organizations include implementing multi-factor authentication, maintaining regular offline backups, and conducting regular security awareness training to defend against phishing and other common entry vectors used by ransomware groups.