Druni Listed by akira Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to pressure organisations by combining encryption with the threat of public data leaks, a tactic that has become a fixture of the current cyber-threat landscape. Retailers and consumer brands, which hold customer records and commercial contracts, remain frequent targets because the potential for reputational and operational harm can accelerate negotiations. Against that backdrop, the Spanish beauty retailer Druni has been named on a leak site operated by the Akira ransomware group.

Public reporting on 23 July 2025 states that Akira listed Druni and claimed to have exfiltrated internal files during a ransomware attack. The number of people affected is unknown, and independent confirmation of the intrusion or the precise contents of any stolen material has not been published. The listing itself is a claim by the group rather than verified fact.

What happened

According to the available record, Druni was listed by the Akira ransomware group on or around 23 July 2025. The group asserts that it conducted a ransomware attack in which internal files were exfiltrated. It further claims it is prepared to upload more than 40 GB of corporate documents. No technical details of the intrusion method, the date of the initial compromise, or any ransom demand have been disclosed in the public summary. The scale of any impact on individuals remains unknown. At present the only concrete public statement is the group’s own leak-site listing and the accompanying description of the material it says it holds.

Who is akira?

Akira is a ransomware operation that became active in early 2023 and has since targeted organisations across multiple sectors and regions. Like many contemporary groups, it typically employs a double-extortion model: systems are encrypted and data are stolen, after which the operators threaten to publish the material if payment is not made. The group maintains a dark-web leak site on which it names victims and, in some cases, releases sample files or larger archives. Public reporting has linked Akira to attacks on manufacturing, professional services, education and retail entities. Its operators have shown a preference for Windows environments and have been observed using both custom ransomware binaries and commodity tools for initial access and lateral movement. Claims made on its leak site are self-reported and should be treated as unverified until corroborated by the victim organisation or independent investigators.

Druni and its sector

Druni is a Spanish retailer specialising in beauty and personal-care products. It sells perfumes, makeup, cosmetics and related items both through physical stores and an online platform, positioning itself as a competitive source for well-known international brands. Companies in this sector routinely manage customer accounts, loyalty programmes, payment data, employee records and commercial contracts with suppliers and brand partners. A breach involving such an organisation can therefore affect both individual consumers and the wider supply-chain relationships that underpin retail operations. Because beauty retail depends heavily on brand reputation and consumer trust, any confirmed exposure of internal or customer information carries commercial as well as privacy consequences.

The information in question

The public facts state that internal files were exfiltrated in a ransomware attack. Akira’s listing claims the material comprises more than 40 GB of corporate documents, including employee files such as DNI (Spanish national identity documents), detailed financials, project data, customer information, and contracts and agreements with major brands including L’Oréal, Dior and Chanel. These descriptions originate solely from the group’s own statement; the exact contents and authenticity of any archive have not been independently verified. Organisations of Druni’s type typically hold customer contact and purchase histories, employee personal data, financial records and supplier contracts. Whether any or all of those categories are present in the claimed 40 GB set remains unconfirmed.

The real-world impact

If the claimed data are genuine and are released, affected individuals could face identity-related risks, particularly if Spanish national identity documents or other personal identifiers appear. Customer information might enable targeted phishing or social-engineering attempts that reference past purchases or account details. For the organisation itself, exposure of financial records or commercial contracts could reveal pricing, margins or partnership terms to competitors and could complicate ongoing supplier relationships. Operational disruption from any encryption component of the attack, if it occurred, would add further cost and recovery effort. Because the number of people affected is unknown and the data have not been independently examined, the precise scope of harm cannot yet be quantified. The primary immediate risk is the potential publication of material that the group asserts it already possesses.

If your data was in this claimed breach

Anyone who has shopped with Druni or worked for the company should treat the possibility of exposure seriously even while details remain limited. Monitor financial and email accounts for unusual activity, enable multi-factor authentication wherever available, and be alert to phishing messages that reference beauty purchases or Spanish identity documents. Consider placing a fraud alert with relevant credit agencies if you are a Spanish resident. Readers can also run a free exposure scan of their email address to check whether their information has already appeared in known breach data sets. If Druni issues official guidance or confirmation, follow the steps it provides. Until then, caution and routine security hygiene remain the most practical responses.

AICompiled with AI assistance from public sources and published under our editorial standards.