Anfarm Hellas Listed by akira Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On 16 April 2025 Anfarm Hellas, a Greek manufacturer of generic pharmaceutical formulations for human use, appeared on the leak site of the akira ransomware group. The group claims it has exfiltrated more than 35 GB of internal corporate files in a ransomware attack. The number of people affected remains unknown and no independent confirmation of the breach has been made public.

Because Anfarm supplies products to 31 countries and acts as a third-party manufacturer for 45 clients, any confirmed compromise of its systems could expose sensitive commercial, employee and partner information. Public detail is limited to the group’s own listing and the data categories it has named.

What happened

According to the listing dated 16 April 2025, akira claims responsibility for a ransomware attack against Anfarm Hellas in which internal files were exfiltrated. The group states it is ready to upload more than 35 GB of material that it describes as essential corporate documents. No technical details of the intrusion method, the precise date of the attack, or any ransom demand have been disclosed by either the company or independent investigators. The scale of any encryption impact on Anfarm’s operations is likewise unconfirmed.

Who is akira?

Akira is a ransomware group that first became active in early 2023. It operates a double-extortion model: after gaining access to a network it both encrypts systems and steals data, then threatens to publish the stolen material on a dedicated leak site if a ransom is not paid. The group has targeted organisations across manufacturing, professional services, education and other sectors, typically using phishing, compromised credentials or exploitation of unpatched remote-access services as initial entry points. Once inside, it moves laterally, disables backups where possible, and stages data for exfiltration before deploying its encryptor. Listings on its leak site constitute claims by the group rather than Reported Facts; victims sometimes negotiate privately or restore from backups without public confirmation of payment or data release.

Who is Anfarm Hellas?

Anfarm Hellas is a pharmaceutical manufacturer specialising in generic formulations intended for human use. It sells its products in 31 countries and provides contract manufacturing services to 45 external clients. Companies of this type routinely hold regulatory filings, batch records, quality-control data, supplier and customer contracts, employee personnel files, and financial records. A breach at such an organisation can therefore affect not only its own workforce but also business partners, healthcare distributors and, indirectly, patients who rely on the continuity and integrity of its supply chain.

What data was at risk

The only data categories named so far come from akira’s own claim. The group asserts that the exfiltrated material includes contact numbers and e-mail addresses of government officials in countries such as Portugal and Spain, detailed financial data (audits, payment details and reports), corporate non-disclosure agreements, employee personal information, and client data. No independent verification of these contents has been published, and the exact volume or sensitivity of any individual file remains unconfirmed. Organisations in the pharmaceutical manufacturing sector typically store additional regulated information—such as product formulas, clinical or stability data, and supply-chain documentation—but whether any of those categories were among the files taken is not known.

Why it matters

If the claimed data were released, employees could face risks of identity fraud, phishing or social-engineering attacks that exploit personal details. Clients and government contacts whose details appear in the files might experience similar targeted outreach. For Anfarm itself, exposure of financial records or NDAs could damage commercial relationships, while any compromise of manufacturing or quality data could raise regulatory questions even if no patient-level health information is involved. Because the company operates across multiple jurisdictions, notification obligations under European and other data-protection regimes may apply once the incident is confirmed. At present these consequences remain potential rather than established, pending verification of what was actually taken and whether any of it has been published.

Were you affected?

If you are a current or former employee, client or partner of Anfarm Hellas, monitor financial accounts and be alert for unexpected communications that reference company business. Change passwords on any accounts that may have shared credentials with work systems, and enable multi-factor authentication where available. Consider placing fraud alerts with credit-reference agencies if you believe personal data may have been exposed. Readers can also run a free exposure scan of their email address to check whether that address has already appeared in known breach data sets. Official confirmation from Anfarm or relevant regulators should be awaited before drawing firm conclusions about individual impact.

AICompiled with AI assistance from public sources and published under our editorial standards.