PACOMARTINEZ listed on Akira ransomware leak site

• Ransomware group: Akira
• Country: Spain
• Sector: Retail & E-Commerce
• Announcement date: March 12, 2025

Akira ransomware group claims data breach at PACOMARTINEZ

The retail company PACOMARTINEZ has reportedly been listed on the leak site associated with the Akira ransomware group. According to the announcement made by the threat actor group, the organization has been targeted in a cyberattack, resulting in the alleged theft of a significant volume of corporate information.

The incident was announced on March 12, 2025, which coincides with the date the group claims the attack took place. The Akira group alleges that they have successfully compromised sensitive documents belonging to the company, posing a potential risk to the organization's digital assets and its ongoing operational continuity.

Details of the alleged data theft

The Akira group claims to be in possession of 46 GB of data belonging to PACOMARTINEZ. While the group has published an announcement regarding the breach, they have not provided any screenshots to verify the contents of the stolen files. No information was provided regarding a ransom demand.

According to the claims made by the group, the leaked data includes a variety of sensitive materials. The specific types of information allegedly involved in the breach include:

• Financial audits
• Payment details
• Reports
• Employee contact information
• Customer contact information
• Internal correspondence

About PACOMARTINEZ

PACOMARTINEZ is a retail chain based in Spain. The company specializes in a variety of consumer goods, including bags, suitcases, accessories, and leather products. Their business model focuses on a concept that merges fashion with travel-related products, offering them to customers at affordable prices.

Analysis and potential impact

The alleged data leak presents several significant risks. For the individuals involved, specifically employees and customers, the exposure of contact information and other details may lead to secondary risks such as identity theft or the execution of targeted phishing campaigns. Such social engineering attacks often follow a data breach, as attackers use the stolen information to gain trust and deceive victims.

From a regulatory perspective, since the organization operates within Spain, this incident may trigger scrutiny from authorities and could lead to potential administrative fines under the General Data Protection Regulation (GDPR). Furthermore, the Akira group is known for utilizing double-extortion tactics. In these scenarios, attackers not only encrypt a victim's systems but also threaten to leak sensitive data to pressure the organization into paying a ransom. The publication of such data can cause lasting damage to an organization's reputation and create negative ripple effects throughout its supply chain.

Regarding the technical nature of the attack, the Akira group is known to exploit vulnerabilities in VPNs to gain access to networks. This suggests that the incident may have originated from security gaps within the organization's network infrastructure. This type of breach highlights the importance of robust perimeter security and continuous monitoring.

For organizations operating in the retail and e-commerce sectors, incidents like this underscore the necessity of maintaining comprehensive data protection and security protocols. Defensive strategies typically involve implementing multi-factor authentication, maintaining strict patch management for remote access tools like VPNs, and conducting regular audits of data access permissions. A comprehensive review of security postures is often required following such an event to mitigate future risks and ensure the integrity of digital operations.