Globatech Listed by akira Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

People whose personal or professional details sit inside a company's systems rarely learn about a breach until a threat actor claims to have taken the files. When the ransomware group known as akira lists an organisation, the immediate practical stakes for employees, clients and partners are straightforward: names, contact details, financial records or contractual papers may now be outside the organisation's control, and the volume and exact contents remain unverified by independent sources.

On 7 November 2025, Globatech appeared on a listing associated with akira. Public detail is limited; the number of people affected is unknown, and no independent confirmation of the claimed data has been published. What is known is that the group asserts it has exfiltrated internal files and intends to release a substantial volume of corporate material. For anyone who has worked with or for Globatech, that claim alone is reason to treat the possibility of exposure seriously.

What happened

According to the reported listing, Globatech was named by the akira ransomware group on 7 November 2025. The group claims to have conducted a ransomware attack that included the exfiltration of internal files. It further states that it will upload approximately 25 GB of corporate documents, describing the material as including employee and client information, financial and accounting data, projects, contacts and agreements, confidential files and NDAs. No independent verification of the attack method, the precise date of intrusion, or the actual contents of the claimed archive has been made public. The number of individuals whose data may be involved remains unknown.

Inside akira

Akira is a ransomware operation that has been active in recent years and is documented for using double-extortion tactics: encrypting systems while also stealing data and threatening to publish it if a ransom is not paid. The group typically posts victims on a dedicated leak site, often accompanied by sample files or volume claims, as a form of pressure. Public reporting on prior incidents shows that akira has targeted organisations across multiple sectors, frequently focusing on mid-sized companies whose operational data and personal records can be leveraged for extortion. In this case, the listing of Globatech is presented by the group itself; it should be treated as an unverified claim rather than confirmed fact unless further evidence emerges.

Who is Globatech?

Globatech is described as comprising six companies that provide 24/7 services throughout Quebec, with an expanded presence across Canada. Its stated purpose is to ensure the health and safety of buildings. Organisations of this type typically maintain records of employees, clients, building projects, contracts, financial transactions and technical documentation related to facility management and safety compliance. Because such firms sit at the intersection of commercial property operations and regulatory requirements, a breach can affect both internal staff and external parties who rely on the company's services for building-related safety and maintenance.

The information in question

The facts name the exposed material only in general terms as internal files exfiltrated in a ransomware attack. The group's own claim expands this to employee and client information, financial and accounting data, projects, contacts and agreements, confidential files and NDAs, with a stated volume of about 25 GB. Exact contents have not been independently confirmed. Organisations that manage building health and safety routinely hold personnel records, client contact lists, contractual documents, project files and financial data; whether any or all of those categories were in fact taken in this incident remains unconfirmed beyond the group's assertion.

What's at stake

For individuals, the practical risks include possible misuse of personal or employment details, targeted phishing that references real projects or contracts, and exposure of financial or contractual information that could be used for fraud or competitive harm. For the organisation, the stakes involve operational disruption, potential regulatory scrutiny, and loss of trust among clients who depend on it for building safety services. Because the scale of affected people is unknown and the precise data set is unconfirmed, the full extent of impact cannot yet be measured. Concrete points that remain open include:

• Whether the claimed 25 GB archive has been released or remains only threatened.
• Which specific employee or client records, if any, are present.
• Whether financial, project or NDA material has been verified by any third party.
• How many individuals may ultimately need to take protective steps.

If your data was in this claimed breach

If you are an employee, client or partner of Globatech, treat the possibility of exposure as real until clearer information appears. Change passwords on any accounts that may have been linked to the company, enable multi-factor authentication where available, and watch for unexpected messages that reference real projects or personal details. Monitor financial statements for unusual activity. Readers can also run a free exposure scan of their email address to check whether their information has already surfaced in known breach data sets. Public detail on this incident remains limited; further verified information, if it emerges, will clarify the next steps.

AICompiled with AI assistance from public sources and published under our editorial standards.