Saxun by Giménez Ganga targeted by Akira ransomware group

• Ransomware group: Akira
• Country: Spain
• Sector: Manufacturing
• Announcement date: October 30, 2025

Akira ransomware group claims data breach at Saxun by Giménez Ganga

The Akira ransomware group has announced that it has exfiltrated data belonging to the Spanish company Saxun by Giménez Ganga. According to the announcement posted on a leak site on October 30, 2025, the threat actor group claims to have gained unauthorized access to the organization's systems, resulting in a significant data breach.

The group alleges that the attack occurred on the same day the announcement was made, October 30, 2025. While the group has claimed responsibility for the incident, they have not provided any information regarding a ransom demand or specific details regarding the method of entry in the initial announcement.

Details of the claimed data exfiltration

The Akira group has stated that they intend to publish 320 GB of corporate data belonging to Saxun by Giménez Ganga. The group claims to have accessed a wide variety of sensitive information, including the company's internal projects, client files, and information pertaining to employees.

The alleged exfiltrated data is reported to include a diverse range of corporate and technical documentation. The specific types of data mentioned in the claim include:

• Employee information
• Client information
• Contracts
• Technical drawings

In addition to the items listed above, the group claims the stolen data contains corporate documents, project files, specifications, and non-disclosure agreements (NDAs). It is important to note that no screenshots were provided by the group to substantiate these claims.

About Saxun by Giménez Ganga

Saxun by Giménez Ganga is a Spanish company specializing in the design and manufacture of sun protection systems. Their product portfolio includes awnings, shutters, and bioclimatic pergola solutions intended for both residential and commercial use. The company operates as a constituent part of the Giménez Ganga group.

Analysis and potential impact of the attack

The Akira group is known for employing a double-extortion strategy. In such scenarios, attackers do not merely encrypt an organization's data to disrupt operations; they also steal sensitive information to use as leverage. By threatening to leak the stolen data on public forums, the attackers aim to pressure the victim into paying a ransom to prevent the exposure of confidential information.

This specific incident presents several significant risks. For the organization, the breach poses a threat to operational continuity. Furthermore, the exposure of employee and client data can lead to serious secondary consequences, such as identity theft or highly targeted phishing attacks directed at the individuals whose information was compromised. Because Saxun by Giménez Ganga is based in Spain, the breach may also trigger legal sanctions and administrative fines under the General Data Protection Regulation (GDPR).

The group's historical patterns suggest that they frequently gain network access by exploiting vulnerabilities in VPN accounts. Such access can create secondary risks for the organization's entire supply chain, as partners may be targeted through the compromised entity. To defend against such threats, organizations often implement multi-factor authentication (MFA) on all remote access points, maintain rigorous patch management for VPN gateways, and conduct regular monitoring of network traffic to detect unauthorized data exfiltration.