El Dorado Stores and Supermarkets Listed by akira Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to target retail and supermarket operators worldwide, using double-extortion tactics that combine encryption with the threat of public data leaks. In this environment, listings on criminal leak sites have become a common signal that an organisation may have suffered a breach, even when independent confirmation remains limited.

On 25 July 2024, the ransomware group known as akira listed El Dorado Stores and Supermarkets on its leak site, claiming to have exfiltrated internal files. The number of people affected is unknown, and public detail about the incident remains limited to the group’s own statements and the organisation’s publicly described profile as a long-established Uruguayan retailer.

What happened

According to the listing dated 25 July 2024, El Dorado Stores and Supermarkets was named by the akira ransomware group as a victim of a ransomware attack in which internal files were exfiltrated. The group stated that it possessed personal employees data, financial documents and internal commercial information, among other materials. It also published instructions for downloading the claimed data via torrent clients and magnet links. No independent confirmation of the attack method, the precise date of intrusion, the volume of data taken, or any ransom demand has been publicly disclosed. The number of individuals potentially affected is unknown.

Inside akira

Akira is a ransomware operation that became active in early 2023 and has since been observed conducting double-extortion campaigns against organisations across multiple sectors and regions. The group typically gains initial access through common vectors such as compromised credentials or unpatched systems, encrypts systems, and simultaneously steals data that it later threatens to publish on a dedicated leak site if payment is not made. Listings on that site serve as both pressure and advertising; they are claims by the group rather than Reported Facts. Akira has previously targeted companies in manufacturing, education, healthcare and retail, often releasing sample files or full archives via torrent to demonstrate possession. Its operations are well-documented in public cybersecurity reporting, though the group’s internal structure and exact membership remain opaque.

El Dorado Stores and Supermarkets and its sector

El Dorado Stores and Supermarkets is described as a family-owned company with 100 percent Uruguayan capital that has operated for 95 years in the supermarket, store and home sectors. Organisations of this type typically manage large volumes of employee records, supplier contracts, inventory systems, financial ledgers and, in many cases, customer loyalty or payment information. A breach affecting such a retailer can disrupt supply chains, expose staff and commercial partners, and erode trust among shoppers who rely on everyday grocery and household goods. Because the company operates in a competitive consumer market, any confirmed compromise of internal systems carries operational and reputational consequences beyond the immediate technical incident.

What was likely exposed

The akira listing claims that personal employees data, financial documents and internal commercial information were among the materials taken. Public reporting does not independently confirm the exact contents or volume of any archive. Organisations in the supermarket and retail sector commonly hold employee personal details (names, identification numbers, contact information, payroll data), financial records (invoices, bank details, accounting files), supplier contracts and internal commercial plans. Whether any customer data was included remains unconfirmed. The precise nature and sensitivity of the files allegedly offered via torrent are therefore known only through the group’s unverified statements.

Why it matters

If the claimed data are authentic, employees could face risks of identity fraud, targeted phishing or unsolicited contact based on leaked personal information. Financial and commercial documents may enable competitive intelligence gathering or further social-engineering attacks against the company and its partners. For the organisation itself, the incident raises questions of operational continuity, potential regulatory notification obligations under applicable data-protection rules, and the cost of forensic investigation and system recovery. Even when the full scope is unknown, the mere public listing can generate uncertainty for staff, suppliers and customers who must decide how to protect themselves.

What to do if you're exposed

Individuals who believe they may have been affected should monitor financial accounts and credit reports for unusual activity, enable multi-factor authentication on email and other accounts, and treat unsolicited messages that reference personal details with caution. Employees of the company may wish to contact their human-resources or security team for official guidance. Anyone concerned that their email address or personal information has appeared in known breach data can run a free exposure scan to check publicly available breach compilations and take further protective steps accordingly.

AICompiled with AI assistance from public sources and published under our editorial standards.