Skira ransomware group claims massive data breach at Innovex Holdings Co., Ltd.

• Ransomware group: Skira
• Country: Japan
• Sector: Technology
• Announcement date: November 18, 2025

The threat actor known as Skira has listed a massive amount of data allegedly belonging to INNOVEX HOLDINGS CO., LTD. on their dedicated leak site. According to the announcement made on November 18, 2025, the group claims to have exfiltrated a significant volume of information from the organization's systems.

The alleged breach and Skira's claims

The Skira group has posted a listing on their online platform claiming that they have successfully obtained data from the systems of INNOVEX HOLDINGS CO., LTD. The threat actor alleges that the breach specifically targeted the company's VMware virtual machines. To support the scale of this alleged intrusion, the group has shared screenshots that purportedly show the internal infrastructure of the organization.

Ransomware groups often utilize leak sites to pressure victims into paying ransoms. This tactic is frequently associated with a method known as double extortion. In a double extortion scenario, attackers do not just encrypt a company's files to disrupt operations; they also steal sensitive data and threaten to publish it publicly if the ransom is not met. This approach significantly increases the pressure on an organization, as the threat of a public data leak can cause lasting damage to commercial reputation and operational continuity.

The scope of the claimed data theft

Based on the screenshots provided by the threat actor, the volume of the compromised data is claimed to be over 30 TB. The stolen information is said to originate from VMware virtual machine data. The specific types of data identified in the claim include several critical databases that could contain highly sensitive information.

Affected data types:

• Fingerprint databases
• Customer databases
• Employee databases

The presence of such diverse datasets, ranging from biometric-related information to personal details of both clients and staff, suggests a high-impact event if the claims are accurate. While the group has provided screenshots to validate their claims, the actual contents and the integrity of the leaked data remain to be verified.

About Innovex Holdings Co., Ltd.

Innovex Holdings Co., Ltd. is a technology company based in Thailand. The company provides technological solutions and services for various industrial and commercial applications, serving a wide range of sectors through its specialized offerings.

Potential impacts and organizational risks

This breach allegation carries significant risks regarding the exposure of sensitive corporate and personal data within INNOVEX HOLDINGS CO., LTD. The potential disclosure of customer and employee databases could lead to individuals being exposed to various secondary threats, such as identity theft and highly targeted phishing attacks. Because the organization is based in Thailand, the company may face legal and administrative sanctions related to compliance with local data protection regulations.

Furthermore, the motivations and operational methods of the Skira group remain uncertain, as public information regarding this specific threat actor is currently limited. In the technology sector, where data integrity and confidentiality are paramount, such incidents can have profound consequences. Organizations in this sector typically focus on robust defensive measures to mitigate these risks, such as implementing strict access controls, maintaining offline backups, and conducting regular security audits of virtualized environments like VMware.

The potential impact on the company's commercial reputation and operational continuity is a primary concern if the group follows through with their threats. As seen in many modern cyberattacks, the transition from a simple network intrusion to a full-scale data leak can create long-term challenges for an organization's trust and legal standing.