Novasport s.r.o. listed on Akira ransomware leak site

• Ransomware group: Akira
• Country: Czechia
• Sector: Retail & E-Commerce
• Announcement date: July 21, 2026

Akira ransomware group targets Novasport s.r.o.

The Akira ransomware group has officially listed the Czech-based organization Novasport s.r.o. on its dedicated leak site. The threat actor group announced its intention to publish a significant volume of corporate data allegedly belonging to the company. This announcement, which was posted on July 21, 2026, serves as a notification of a potential data breach involving the retail and e-commerce entity.

The group has claimed that the stolen data amounts to approximately 17 GB. According to the announcement, the threat actors intend to release various files related to the company's internal operations and business data. While the group has made these claims, no screenshots were provided in the leak site post to verify the contents of the stolen information. The announcement type is categorized as a data leak notification, indicating the group's intent to move forward with public disclosure if their demands are not met.

Details of the claimed data theft

The Akira group's claim involves a wide variety of sensitive information that could impact multiple stakeholders within the organization. The group alleges that the stolen data includes critical documents that are central to the company's administrative and commercial functions. According to the claim, the following types of information are included in the 17 GB of data:

• Employee passport information
• Project files
• Contracts
• Financial data
• Client information

The inclusion of such sensitive documentation suggests a high level of access to the organization's internal systems. The presence of identity documents and financial records in the hands of a ransomware group typically indicates a high-risk scenario for the targeted entity.

About Novasport s.r.o.

Novasport s.r.o. is a specialized manufacturer based in Czechia. The company is recognized for producing the LEKI brand of high-performance gear, specifically ski, hiking, and Nordic walking poles. Founded in 1992 by Klaus Lenhart, the organization has established a significant presence in the sporting goods market through collaborations with top athletes worldwide.

Potential impact and security implications

If the alleged data leak is verified, the consequences for Novasport s.r.o. could be extensive. The exposure of employee passport information and client data poses a direct risk of identity theft for the individuals involved. Furthermore, because the company operates within the Czech Republic, it is subject to the General Data Protection Regulation (GDPR). A breach of this nature could lead to significant administrative sanctions due to the failure to protect personal data under these strict regulatory frameworks.

The Akira group is known for employing a double-extortion method. In this tactic, attackers not only encrypt a company's systems but also steal sensitive data to use as leverage, threatening to leak it publicly to pressure the victim into paying the ransom. This method is designed to maximize damage to a company's commercial reputation and can create negative ripple effects throughout its entire supply chain. Additionally, the leakage of financial and contractual data provides a roadmap for threat actors to launch highly targeted phishing attacks against the company's business partners.

Publicly available information regarding the Akira group indicates that they have been active since 2023. The group is known for targeting vulnerabilities in Virtual Private Networks (VPNs) to gain initial access to corporate environments. For organizations in the retail and e-commerce sectors, maintaining robust security postures is essential. This includes implementing multi-factor authentication, ensuring all VPN configurations are patched against known vulnerabilities, and maintaining strict data minimization practices to reduce the impact of a potential breach. Regular audits of access controls and employee training on identifying phishing attempts are also standard defensive measures to mitigate the risks posed by sophisticated ransomware groups.