Laboratorios Belloch listed on Akira ransomware leak site

• Ransomware group: Akira
• Country: Spain
• Sector: Manufacturing
• Announcement date: May 26, 2025

Akira ransomware group claims data breach at Laboratorios Belloch

The Akira ransomware group has listed the Spanish personal care and cosmetics manufacturer Laboratorios Belloch on its dedicated leak site. According to the announcement made on May 26, 2025, the threat actors claim to have successfully exfiltrated a significant amount of corporate information from the organization's systems.

The incident, which the group claims occurred on May 16, 2025, involves a purported theft of 25 GB of data. The threat actors have indicated their intention to publish the stolen information if their demands are not met. While the group has made this claim on their leak site, no screenshots were provided to verify the contents of the alleged breach.

Details of the alleged data theft

The Akira group claims to have obtained a wide variety of sensitive files belonging to Laboratorios Belloch. The nature of the data suggests an attempt to target both the operational and administrative foundations of the company. According to the group's announcement, the stolen information includes the following types of data:

• Financial data
• Client information
• Contracts
• Corporate correspondence
• Personal employee documents

The inclusion of such diverse data types—ranging from financial records to personal employee documents—highlights the broad scope of the alleged intrusion. Such a collection of data typically includes project files and various forms of internal communication that are vital to the daily operations of a manufacturing firm.

About Laboratorios Belloch

Laboratorios Belloch is a company based in Spain that operates within the manufacturing sector. The organization specializes in the development and production of personal care and cosmetic products. Their product portfolio includes various brands, such as Nelly, Yunsey, and Fresh Feel, with a specific focus on hair care and body care solutions.

Potential risks and security implications

This incident may pose significant risks to the organization's operational processes and its commercial reputation. Because the alleged data includes sensitive client information and contracts, the breach could lead to secondary risks, such as identity theft or targeted phishing attacks directed at both employees and customers. Furthermore, as the organization is based in Spain, the breach may trigger legal obligations regarding data breach notifications and potential administrative sanctions under the General Data Protection Regulation (GDPR).

The Akira group is known for employing a double extortion method. This tactic involves not only encrypting an organization's data to disrupt operations but also threatening to leak the stolen data publicly to increase pressure on the victim. The potential publication of such data could result in negative consequences regarding the organization's privacy policies and public trust.

From a technical perspective, the group has shown a tendency to exploit vulnerabilities in Virtual Private Networks (VPNs) to gain initial access to networks. This pattern suggests that organizations in the manufacturing and personal care sectors may need to conduct thorough reviews of their network security processes, particularly regarding remote access points. To mitigate such risks, organizations often implement multi-factor authentication, continuous monitoring of network traffic, and regular patching of external-facing services to prevent unauthorized access.