NyN listed on Akira ransomware leak site

• Ransomware group: Akira
• Country: Spain
• Sector: Professional Services
• Announcement date: June 9, 2025

Akira ransomware group targets NyN

The Akira ransomware group has officially listed the Spanish real estate development company NyN on its dedicated leak site. According to the announcement made on June 9, 2025, the threat actors claim to have successfully exfiltrated a significant volume of corporate information from the organization. This development follows a period of inactivity regarding this specific target, as the group alleges the initial intrusion occurred on May 28, 2025.

The threat actor's claims suggest a targeted operation aimed at extracting sensitive information from the company's various business divisions. While the listing serves as a public notification of the alleged breach, it is important to note that the group has not provided any screenshots to verify the authenticity of the stolen files. Furthermore, no specific ransom demand has been disclosed in the public announcement.

Details of the alleged data exfiltration

The Akira group claims to have exfiltrated approximately 30 GB of corporate data belonging to NyN. The group alleges that the stolen information is not limited to a single department but spans across multiple areas of the organization's operations. Specifically, the threat actor claims that the data includes financial records pertaining to the company's hotels and other various business divisions.

The listing identifies several specific categories of sensitive information that have allegedly been compromised. According to the group's announcement, the data includes:

• Financial data
• Internal correspondence
• Employee personal data
• Contracts
• Client data
• Non-disclosure agreements

The exposure of such a wide variety of data types—ranging from internal communications to legal agreements—highlights the potential impact of the incident on the organization's internal operations and external obligations.

About NyN

NyN is a real estate development company that maintains an active operational presence in Barcelona and its surrounding provinces. The company manages a diverse portfolio of projects, which includes the development and management of hotels as well as various other business divisions. Because of its involvement in the hospitality and real estate sectors, the company handles a significant amount of sensitive client and financial information.

Risk assessment and implications

This alleged data breach may increase the risk of identity theft or targeted phishing attacks against NyN's employees and clients. The exposure of internal correspondence and financial records could damage the company's commercial reputation and negatively impact its competitive position. As the entity operates in Spain, this incident may lead to legal sanctions and administrative fines under the EU General Data Protection Regulation (GDPR).

The Akira group is known for utilizing double-extortion tactics. In these types of attacks, the threat actors do not just encrypt the victim's data to demand a ransom for decryption; they also steal sensitive information and threaten to publish it on a leak site to pressure the victim into paying. This secondary layer of extortion significantly increases the pressure on organizations, as the publication of data can lead to long-term reputational and legal consequences even if the systems are successfully restored from backups.

The Akira group is recognized as a Ransomware-as-a-Service (RaaS) operation that has been active since early 2023. This group frequently targets networks by exploiting vulnerabilities in VPN accounts to gain initial access to corporate environments. For organizations in the professional services and real estate sectors, maintaining robust security protocols around remote access points and implementing strict data loss prevention measures are critical defensive steps to mitigate the risk of similar exfiltration events.