Los Andes Listed by akira Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On December 09, 2024, the Argentine newspaper Diario Los Andes was listed by the ransomware group known as akira. Public reporting indicates that internal files were exfiltrated during a ransomware attack, though the number of people affected remains unknown and many operational details have not been disclosed. The listing itself constitutes a claim by the group rather than independent confirmation of every asserted detail.

For a regional newspaper serving Mendoza and owned by Grupo Clarín together with the heirs of the Calle Family, any compromise of corporate systems raises practical questions about employee contact data, financial records and the continuity of news operations. What is known so far is limited to the group's public listing and the description of the material it says it holds.

Inside the incident

According to the available record, Diario Los Andes appeared on an akira-associated leak site on or around December 09, 2024. The group stated that it had exfiltrated internal files in a ransomware attack and was prepared to upload a large volume of private corporate documents. Those documents were described as including financial data such as audits, payment details and reports, as well as contact numbers and e-mail addresses of employees. No further technical indicators, initial access method, encryption status of systems, or exact volume of data have been publicly confirmed. The number of individuals whose information may be involved is listed as unknown. Independent verification of the full scope or of any subsequent data release has not been supplied in the facts available.

Inside akira

Akira is a ransomware operation that has been active in public reporting since early 2023. The group typically employs a double-extortion model: encrypting systems while also copying data and threatening to publish it if a ransom is not paid. Listings on its leak site serve as both pressure and advertisement; the presence of a victim name is therefore a claim by the operators, not an automatic confirmation that every file they describe has been released or that every assertion is accurate. Akira has previously targeted a range of mid-sized organisations across manufacturing, professional services and other sectors, often using stolen credentials or exploited vulnerabilities for initial access and then moving laterally to locate valuable data. Public analyses of the group's tooling and negotiation style are well documented, yet none of those general patterns should be read as proven facts about the specific Los Andes incident beyond what the listing itself states.

Los Andes and its sector

Diario Los Andes is a morning newspaper based in Mendoza, Argentina, and forms part of the broader media holdings associated with Grupo Clarín and the Calle family heirs. As a regional daily it produces news, maintains editorial and commercial staff, manages advertising and subscription relationships, and holds the ordinary corporate records required to operate a news organisation. Media companies of this type routinely store employee directories, payroll and financial documentation, vendor contracts, and sometimes source or subscriber contact information. A breach affecting such an organisation can therefore touch both the workforce and the operational continuity of local journalism, even when the precise data set remains unconfirmed.

The information in question

The facts name the exposed material only as internal files exfiltrated in a ransomware attack. The group claims these files encompass financial data (audits, payment details, reports) together with employee contact numbers and e-mail addresses. Exact contents, file counts, and whether any personal data of readers or sources were included have not been independently verified. Organisations in the newspaper sector typically hold employee records, financial ledgers, vendor information and internal correspondence; those categories align with the types the group has listed, yet the precise inventory for this incident remains unconfirmed. No public statement has established that customer or subscriber databases were among the taken files.

The real-world impact

If employee contact details and financial records were in fact copied, staff could face phishing or social-engineering attempts that reference genuine workplace information. Payment and audit data, if authentic, might be misused for fraud or competitive intelligence. For the newspaper itself, the incident can create operational disruption, legal notification obligations under Argentine data-protection rules, and reputational questions among readers and advertisers. Because the number of affected individuals is unknown and the full data set is unconfirmed, the concrete scale of harm cannot yet be measured. The primary risks remain those common to any corporate ransomware event involving internal documents: targeted scams against employees and the possible public release of sensitive business information.

What to do if you're exposed

Anyone who has worked for or closely with Diario Los Andes should treat unsolicited messages that reference internal matters with caution, verify requests through known channels, and monitor financial accounts for unusual activity. Changing passwords on work-related and personal accounts that share credentials, and enabling multi-factor authentication where available, are prudent first steps. Readers concerned that their own e-mail address may have appeared in this or other incidents can run a free exposure scan of their email to check whether their information has surfaced in known breach data. Official updates, if any, will come from the organisation or relevant authorities rather than from leak-site claims alone.

AICompiled with AI assistance from public sources and published under our editorial standards.