Vicky Foods targeted by Akira ransomware group

• Ransomware group: Akira
• Country: Spain
• Sector: Agriculture and Food Production
• Announcement date: February 12, 2025

Akira ransomware group claims data breach at Vicky Foods

The Akira ransomware group has listed data belonging to Vicky Foods on its leak site, claiming to have successfully breached the organization's networks. According to the announcement published on February 12, 2025, the threat actors allege they have obtained a significant amount of sensitive corporate documentation. The group claims the breach occurred around January 21, 2025, and involves a substantial volume of stolen information.

Details of the alleged data theft

While no screenshots have been provided to verify the contents of the leak, the Akira ransomware group claims to have exfiltrated over 10 GB of data. The threat actor alleges that they gained unauthorized access to the organization's internal networks, allowing them to harvest various types of sensitive information. The nature of the announcement suggests that the data may originate from various production facilities operated by the company.

The information allegedly contained in the leak includes a wide range of sensitive documents and personal identifiers. The specific data types mentioned by the group include:

• Employee contact information
• Customer contact information
• DNI numbers
• Personal signatures
• Financial data
• Licenses
• Contracts

The presence of such diverse data types—ranging from personal identification numbers to confidential business contracts—indicates a broad scope of the alleged intrusion.

Impact and potential risks

The exposure of this data poses significant secondary risks to both the organization and the individuals involved. For employees and customers, the theft of contact details, DNI numbers, and personal signatures increases the risk of identity theft and highly targeted phishing attacks. Such attacks often leverage stolen personal information to gain trust and manipulate victims into revealing further credentials or financial assets.

From a corporate perspective, the alleged leak of financial and operational data could lead to a loss of commercial reputation. Furthermore, the exposure of sensitive contracts and licenses may create vulnerabilities within the organization's supply chain security. The nature of the data involved suggests that the organization could be in breach of data protection obligations under the General Data Protection Regulation (GDPR), which could potentially lead to administrative sanctions.

Understanding the threat actor and tactics

The Akira group is known to operate as a Ransomware-as-a-Service (RaaS) entity. This business model allows developers to lease their ransomware code to affiliates who then carry out the actual attacks. Akira is frequently reported to use double extortion tactics. In a double extortion scheme, the attackers do not just encrypt the victim's files to disrupt operations; they also steal sensitive data and threaten to leak it on a public site if the ransom is not paid. This adds significant pressure on the victim, as the threat of data exposure remains even if systems are restored from backups.

In terms of initial access, the Akira group is reported to frequently exploit vulnerabilities in Virtual Private Networks (VPNs) to gain entry into target networks. Once inside, they move laterally to identify and exfiltrate high-value data.

Defensive considerations for the sector

For organizations operating in critical sectors like agriculture and food production, maintaining robust cybersecurity posture is essential to protect both operational continuity and sensitive stakeholder information. General defensive strategies often include implementing multi-factor authentication (MFA) across all remote access points, particularly VPNs, to mitigate the risk of credential exploitation. Regular patching of internet-facing vulnerabilities is also a fundamental requirement to prevent unauthorized entry.

Furthermore, organizations should prioritize data minimization and encryption to ensure that even if a breach occurs, the stolen data is not immediately usable by threat actors. Implementing strict network segmentation can also help limit the ability of an attacker to move from an initial entry point to sensitive production or financial databases. Continuous monitoring and incident response planning are vital to detecting and reacting to unauthorized access before large-scale exfiltration can occur.