FELA (EVYTRA) Listed by akira Ransomware Group: Ransomware Claim — What’s Alleged & What To Do
FELA (EVYTRA) was listed by the Akira ransomware group on November 20, 2025, after internal files were exfiltrated in an attack whose timing has not been established. Anyone connected to the organisation should check whether their information was exposed and take the recommended protective steps.
On November 20, 2025, the Akira ransomware group listed FELA (EVYTRA) on its data-leak site and stated that it had exfiltrated internal files from the company. The number of individuals affected remains unknown, and no independent confirmation of the data volume or contents has been made public.
The incident adds to a pattern of ransomware operations targeting manufacturers that hold both technical designs and employee records. Such listings draw attention because they signal that corporate systems were accessed and material was removed before encryption occurred.
Breaking down the breach
The only confirmed public information is the listing itself and the date it appeared. The Akira group asserted that it would publish 91 GB of material, including employee identity documents, financial records, client files and contracts. No details on the initial access method, the duration of the intrusion, or whether any data has actually been released have been disclosed.
Who is akira?
Akira is a ransomware operation that emerged in early 2023 and has since conducted intrusions against organizations in multiple countries. Public reporting shows the group typically uses double-extortion tactics: it encrypts systems and also removes data, then threatens to publish the stolen material if a ransom is not paid. The group maintains a leak site where it lists victims and posts samples or descriptions of claimed holdings.
Who is FELA (EVYTRA)?
FELA (EVYTRA) develops and manufactures electronic components, notably human-machine interfaces and printed circuit boards. Companies in this sector routinely maintain engineering drawings, supplier agreements, quality-control records and employee documentation required for regulatory compliance and international trade. A breach at such a firm can expose both proprietary technical information and personal data of staff.
What was likely exposed
The Akira listing claims the exfiltration of internal corporate documents, employee personal data for at least 55 individuals (including identity cards, passports, driver licenses, phone numbers and email addresses), financial and accounting records, client files, contracts, agreements and non-disclosure agreements. The precise contents, file formats and whether any of the material has been published remain unconfirmed by the company or by independent investigators.
The real-world impact
Individuals whose identity documents and contact details appear in the claimed data set face an elevated risk of targeted phishing or identity misuse. The organization may encounter follow-on attempts to leverage any technical specifications or contractual details that were removed. Both outcomes depend on whether the material is actually distributed and on how quickly affected parties are notified.
Were you affected?
Begin by monitoring official statements from FELA (EVYTRA) for any notification process. Change passwords for any corporate or personal accounts that may be referenced in the claimed data and enable multi-factor authentication where available. Readers can also run a free exposure scan of their email address against known breach data sets to check for prior appearances of their information.
AICompiled with AI assistance from public sources and published under our editorial standards.
How this breach connects
More recent breaches
Vardeco Listed by akira Ransomware GroupJ. SCHNEEBERGER Maschinen AG Listed by akira Ransomware GroupBauer-Walser AG Listed by akira Ransomware GroupPIBOR ISO SA Listed by akira Ransomware GroupLatest breaches
Read GalaxyWarden’s full analysis of the FELA (EVYTRA) Listed by akira Ransomware Group →
Publicly posted by akira — unverified claim, pending independent verification
Breach listings — particularly those originating from ransomware or leak sites — are third-party claims that may be unverified, incomplete, or inaccurate. A listing does not by itself confirm that a breach occurred or that any specific data was exposed. Severity is an automated assessment, not a definitive rating. Verification status is shown where available.
Attributions to threat groups and methods reflect public reporting and, in some cases, unverified claims made by the groups themselves; they may be incomplete or later revised. Recent Breaches and GalaxyWarden are independent and are not affiliated with, and do not endorse, any company or group named on this page. This information is aggregated from public sources for awareness only and is not legal, security, or investment advice.