Nexia Poyiadjis IT listed on hunters ransomware leak site

• Ransomware group: hunters
• Country: Cyprus
• Sector: Technology
• Announcement date: April 5, 2025

The hunters claims Nexia Poyiadjis IT data was exfiltrated and encrypted

The ransomware group known as hunters has officially listed the Cyprus-based organization Nexia Poyiadjis IT on its dedicated leak site. According to the announcement published on April 5, 2025, the threat actors claim to have successfully carried out a cyberattack against the firm. The group alleges that the breach involved a double extortion tactic, claiming that the organization's data has been both exfiltrated from their systems and encrypted by the attackers.

In modern ransomware operations, double extortion is a common strategy where attackers do not merely lock the victim's systems but also steal sensitive information. This allows the threat actors to threaten the public release of the stolen data if a ransom is not paid, significantly increasing the pressure on the targeted organization. Such tactics aim to maximize leverage by threatening both operational continuity and reputational integrity.

Details of the alleged breach

The announcement made by the hunters group was accompanied by a screenshot intended to substantiate their claims. This visual evidence indicates that the organization's data has indeed been subject to both encryption and exfiltration. However, despite the claims made by the group, the listing does not provide a detailed list regarding the specific content or types of the leaked data.

The listing names no specific data types that have been compromised. While the group asserts that data has been taken, the exact nature of the files—whether they include financial records, client communications, or internal corporate documents—remains unknown based on the available information from the leak site.

About Nexia Poyiadjis IT

Nexia Poyiadjis is an independent accounting, audit, and consulting firm that is headquartered in Cyprus. As a professional services provider, the firm is a member of the Nexia International network. Through this global affiliation, the organization provides a wide range of financial services and tax advisory solutions to various businesses.

Risk assessment and implications

The hunters group, which emerged in 2023, is assessed to be linked to the Hive ransomware code. The group's recent activity is notable, especially considering their announcement that they ceased encryption activities in 2025, which may indicate a potential shift in their operational strategies.

The implications of this incident are multifaceted. Because the organization is based in Cyprus, the breach may lead to legal and administrative sanctions under the GDPR (EU General Data Protection Regulation). Furthermore, the exfiltration of the organization's data may pose secondary risks, such as identity theft or targeted phishing attacks aimed at the employees and clients of the firm. Given that Nexia Poyiadjis operates within the technology sector, this incident may also be viewed as an additional risk factor in terms of potential supply chain attacks.

For organizations operating in the technology and professional services sectors, maintaining robust defensive postures is critical. Common defensive steps include implementing multi-factor authentication, maintaining offline backups, and conducting regular security audits to mitigate the risk of unauthorized access. As attackers continue to evolve, organizations must remain vigilant against the risk of being used as a gateway for broader supply chain compromises.