ADUANAS Y SERVICIOS FORNESA SL Listed by avaddon Ransomware Group: Ransomware Claim — What’s Alleged & What To Do
The ADUANAS Y SERVICIOS FORNESA SL Listed by avaddon Ransomware Group (reported September 9, 2021) is an unverified claim; the data involved is undisclosed belonging to roughly unknown people. If you have an account with them, your information may now be circulating on the open web and with data brokers. Here’s exactly what happened, how to check if you were affected, and what to do next.
Breaking down the breach
The only confirmed information is the appearance of the company on the Avaddon leak site. The group claims to have exfiltrated internal files as part of a ransomware operation. No details on the date of the intrusion, the volume of data, the encryption status of systems, or any ransom demand have been made public. The number of individuals whose information may be involved is listed as unknown.
The group behind it: avaddon
Avaddon is a ransomware operation that emerged in 2020 and follows a double-extortion model. After encrypting files on targeted systems, the group also removes copies of data and threatens to publish them unless a ransom is paid. The group has maintained a leak site where it lists organisations it claims to have compromised. Public reporting has documented Avaddon activity against entities in multiple countries and sectors, with the group typically using phishing or remote-desktop vulnerabilities to gain initial access.
About ADUANAS Y SERVICIOS FORNESA SL
ADUANAS Y SERVICIOS FORNESA SL operates in the customs and logistics services sector, handling import and export documentation for clients. Organisations of this type routinely process shipping manifests, commercial invoices, transport contracts, and identifying details of individuals and companies involved in cross-border trade. Such records can include names, addresses, tax identifiers, and transaction histories that are required for regulatory compliance.
What was likely exposed
The listing refers only to “internal files” without further specification. The exact categories of data therefore remain unconfirmed. Companies in this sector commonly hold client correspondence, customs declarations, and records containing personal or commercial information; however, whether any of these categories were among the exfiltrated material has not been verified.
Why it matters
Exposure of customs and logistics records can affect both the organisation and the individuals or businesses named in those files. Personal or commercial identifiers may be used for targeted fraud or for mapping supply-chain relationships. For the company, the incident adds operational disruption from any encryption that occurred and potential regulatory scrutiny over the handling of client data. The absence of Reported Details on scale or content leaves the full extent of these risks unknown at present.
What to do if you're exposed
Individuals who have conducted business with customs or logistics firms can monitor their financial and email accounts for unusual activity and consider placing fraud alerts with credit agencies. Changing passwords for any accounts linked to the affected organisation and enabling multi-factor authentication where available are standard first steps. Readers may also run a free exposure scan of their email address against known breach data to check for appearances in previously published incidents.
AICompiled with AI assistance from public sources and published under our editorial standards.
How this breach connects
More recent breaches
Accounts IQ Listed by avaddon Ransomware GroupSyndex Listed by avaddon Ransomware GroupCarlos Federspiel & Co SA Listed by avaddon Ransomware GroupServilex Advocaten Listed by avaddon Ransomware GroupLatest breaches
Publicly posted by avaddon — unverified claim, pending independent verification
Breach listings — particularly those originating from ransomware or leak sites — are third-party claims that may be unverified, incomplete, or inaccurate. A listing does not by itself confirm that a breach occurred or that any specific data was exposed. Severity is an automated assessment, not a definitive rating. Verification status is shown where available.
Attributions to threat groups and methods reflect public reporting and, in some cases, unverified claims made by the groups themselves; they may be incomplete or later revised. Recent Breaches and GalaxyWarden are independent and are not affiliated with, and do not endorse, any company or group named on this page. This information is aggregated from public sources for awareness only and is not legal, security, or investment advice.