Tara Pac listed on Akira ransomware leak site

• Ransomware group: Akira
• Country: Sweden
• Sector: Agriculture and Food Production
• Announcement date: July 10, 2025

Akira ransomware group claims data breach at Tara Pac

The Akira ransomware group has officially listed the Swedish organization Tara Pac on its dedicated leak site. According to the announcement made on July 10, 2025, the threat actor group claims to have successfully targeted the company, alleging that they have obtained a significant volume of sensitive information. This development follows the group's established pattern of using public leak sites to announce successful intrusions and to exert pressure on their victims.

The group has claimed that they have acquired approximately 6 GB of data allegedly belonging to Tara Pac. While the group has made this public announcement, it is important to note that the breach remains a claim made by the ransomware group. The presence of an organization on a leak site is a common tactic used by modern cybercriminals to increase the visibility of an attack and to intimidate the victim into meeting specific demands.

Details of the claimed data theft

The Akira group has stated that they intend to publish the stolen information if their demands are not met. The group claims to have obtained various documents related to the corporate operations of Tara Pac. This type of data theft is a core component of modern ransomware campaigns, where the goal is not just to encrypt systems, but to steal information that can be used for further extortion.

According to the announcement, the stolen data includes several categories of sensitive information. Although no screenshots were provided to verify the contents of the stolen files, the group claims the following types of data are involved:

• Agreements
• Financial data
• Client data
• Employee data

The disclosure of such diverse data types suggests a broad intrusion into the company's digital environment, potentially touching upon multiple departments and administrative functions.

About Tara Pac

Tara Pac is a prominent organization operating within the Nordic region. The company serves as a leading supplier of packaging solutions, catering to a diverse range of industries. Their service portfolio extends across several critical sectors, including food, construction, chemistry, and cosmetics. As a key player in the supply chain for these industries, the company handles a variety of sensitive information related to its operations and its diverse client base.

Analysis and potential impact

This leak claim poses a significant risk of exposure for sensitive corporate and personal data held by Tara Pac. The potential disclosure of client and employee information could lead to various secondary threats, such as identity theft or highly targeted phishing attacks against the individuals whose data has been compromised. Furthermore, because the company is based in Sweden, this incident may trigger legal and administrative consequences under the EU General Data Protection Regulation (GDPR), which mandates strict protections for personal data.

The Akira group is recognized as a Ransomware-as-a-Service (RaaS) entity that has been active since early 2023. This group is known for frequently utilizing compromised VPN accounts to gain unauthorized access to target systems. Their methodology often involves double-extortion tactics, where the attackers not only encrypt the victim's data but also threaten to leak it publicly. This approach is designed to maximize pressure on the organization, impacting both operational continuity and commercial reputation.

In such scenarios, organizations typically face immense pressure to manage both the technical recovery of their systems and the legal ramifications of a data breach. For companies in the food production and packaging sectors, maintaining the integrity of supply chain data and client confidentiality is paramount. Protecting against such threats often involves rigorous security measures, such as securing remote access points, implementing multi-factor authentication, and maintaining robust monitoring to detect unauthorized access early in the attack lifecycle.