Getrix Listed by akira Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On 24 October 2023, the ransomware group known as akira listed Getrix on its leak site, claiming to have exfiltrated internal files in a ransomware attack. Public detail on the incident remains limited: the number of people affected is unknown, and independent confirmation of the full scope has not been published. For clients, property owners, tenants and partners whose records may sit inside a widely used Italian real-estate management platform, the practical stakes are straightforward—personal and contractual data could be at risk of further exposure or misuse if the claim is accurate.

What is known comes chiefly from the group’s own listing. That listing asserts that roughly 10 GB of material, including client information, contracts and real-estate and building data, was taken and would be made available. Until verified by the organisation or independent investigators, those assertions remain claims rather than established fact.

Breaking down the breach

According to the reported listing dated 24 October 2023, Getrix was named by the akira ransomware group as a victim of a ransomware attack in which internal files were exfiltrated. The group’s summary described Getrix as the most used real-estate management software in Italy and stated that the stolen archive contained client information, contracts, and real-estate and building information, totalling about 10 GB, with the archive said to be available soon. No public technical details have been released about the initial access method, the duration of any intrusion, or whether encryption was also deployed on Getrix systems. The number of individuals or entities whose data may be involved has not been disclosed. Beyond the leak-site claim itself, further independent corroboration of the incident’s scale or contents is not available in the public record.

Who is akira?

Akira is a ransomware operation that became publicly active in 2023. Like many contemporary groups, it is associated with a double-extortion model: data is copied from victim networks before systems are encrypted, and the group then pressures the organisation by threatening to publish the stolen material on a dedicated leak site if a ransom is not paid. Akira has been observed targeting a range of sectors and geographies, often focusing on mid-sized organisations that hold commercially or personally sensitive records. The group typically posts short victim descriptions and file-volume claims on its site; those posts constitute unverified assertions until confirmed by the affected organisation or by forensic evidence. In this case, the listing of Getrix should be read as such a claim. No additional statements attributed to akira about Getrix beyond the summary already noted have been reported.

Getrix and its sector

Getrix is described in the leak-site material as the most used real-estate management software in Italy. Platforms of this type are used by property managers, agencies, landlords and related service providers to handle day-to-day operations—tenant and owner records, lease and sales contracts, building specifications, maintenance logs and financial or administrative correspondence. Because the software sits at the centre of property transactions and ongoing management, it routinely concentrates data that is both commercially valuable and personally identifiable. A breach affecting such a system is consequential precisely because the same platform may serve many clients across the Italian real-estate market; any successful exfiltration could therefore touch a wide circle of individuals and businesses even if the exact headcount remains unknown.

What was likely exposed

The only data types named in connection with the incident are internal files said to have been exfiltrated in a ransomware attack. The akira listing further claims that the material comprises client information, contracts, and real-estate and building information, amounting to roughly 10 GB. Exact contents have not been independently confirmed, and the number of people affected is unknown. Organisations running real-estate management platforms typically hold records such as:

• Names, contact details and identification data of clients, owners and tenants
• Lease, sale and service contracts
• Property addresses, building specifications and related documentation
• Administrative or financial correspondence tied to those properties

Whether any or all of those categories were in fact present in the alleged archive cannot be verified from the public facts alone. Readers should treat the group’s description as an unverified claim.

The real-world impact

If the exfiltrated files contain the kinds of records commonly stored in real-estate management systems, affected individuals could face risks of phishing, social-engineering attempts that reference genuine contracts or properties, or longer-term identity-related fraud. Businesses whose contracts or client lists appear in the material may encounter competitive harm, contractual disputes or regulatory notification duties under applicable data-protection rules. For Getrix itself, the listing creates reputational pressure and the operational cost of investigation, containment and customer communication, regardless of whether a ransom was ever paid. Because the headcount of affected people remains undisclosed and the archive’s precise contents unconfirmed, the full extent of harm cannot yet be measured; the prudent assumption is that anyone whose data resided in the platform should monitor for unusual contact or account activity.

What to do if you're exposed

If you have used Getrix-managed services or believe your details may have been stored in the platform, take a few measured steps. Monitor bank, email and property-related accounts for unexpected messages or changes. Treat unsolicited requests that reference specific contracts or addresses with caution and verify them through known official channels. Consider placing fraud alerts with relevant credit or identity services where available in your jurisdiction. Keep records of any suspicious contact. You can also run a free exposure scan of your email address to check whether your information has already surfaced in known breach data sets; doing so gives an early indication of whether further monitoring is warranted. Public detail on this incident is still limited, so staying alert to official statements from Getrix or Italian authorities remains the most reliable way to learn of confirmed next steps.

AICompiled with AI assistance from public sources and published under our editorial standards.