Paratus Listed by akira Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to target critical infrastructure and service providers across regions, using data theft and public leak-site postings as leverage. Listings of this kind have become a routine feature of the current threat landscape, where operators claim to hold corporate material and threaten release unless demands are met. Against that backdrop, the appearance of Paratus on a ransomware group's site in mid-February 2025 fits a familiar pattern of claimed network compromises against telecommunications and connectivity firms.

On 19 February 2025, the organisation known as Paratus was listed by the ransomware group that calls itself akira. Public reporting states that internal files were exfiltrated in a ransomware attack; the number of people affected remains unknown. The listing itself is a claim by the group, which asserts it is ready to upload more than 84 GB of corporate documents. Exact confirmation of the intrusion method, the full scope of access, or independent verification of the claimed volume has not been disclosed in the available record.

Inside the incident

What is known rests on the group's leak-site listing and the accompanying public summary. Paratus was named as a victim of a ransomware attack in which internal files were said to have been taken. The reported date of the listing is 19 February 2025. No further technical detail—such as the initial access vector, the duration of any dwell time, or whether encryption was also deployed—has been made public. The scale of impact on individuals is listed as unknown. The group states it holds more than 84 GB of material and characterises the content as essential corporate documents. Beyond that claim, the precise timeline of the intrusion and any subsequent negotiations remain undisclosed.

Because the primary source is the threat actor's own posting, the incident should be treated as an unverified claim of compromise until corroborated by the organisation or by independent forensic reporting. No dollar amounts, ransom demands, or confirmed file inventories appear in the available facts.

The group behind it: akira

Akira is a ransomware operation that has been active in recent years and is publicly documented for employing double-extortion tactics: encrypting systems while also stealing data and threatening to publish it on a dedicated leak site if payment is not made. The group typically targets mid-sized and larger organisations across multiple sectors, including technology, manufacturing, and professional services. Its operators have been observed using common initial-access methods such as compromised credentials or vulnerable remote-access services, followed by lateral movement and data staging before encryption. Prior public activity includes numerous listings of corporate victims accompanied by sample file dumps intended to pressure payment.

In this case, the group claims to have exfiltrated internal files from Paratus and to be prepared to release more than 84 GB of material. That assertion is presented solely as the group's own statement; no independent confirmation of the volume or the specific contents has been supplied in the record. Akira's leak-site postings are therefore best understood as pressure tactics rather than verified inventories.

About Paratus

Paratus describes itself as Africa’s quality network provider, focused on infrastructure investment and the delivery of integrated network services across the continent. Organisations of this type typically operate fibre, wireless, and data-centre connectivity that underpins business, government, and consumer communications. They routinely handle customer account information, employee records, contractual documents, and financial and operational data necessary to run large-scale network services.

A claimed breach at such a provider is consequential because network operators sit at the centre of regional connectivity. Disruption or exposure of their internal systems can affect service continuity for many downstream customers and can place sensitive personal and commercial information at risk. The available facts do not establish negligence or any specific security shortcoming; they simply record that the organisation was listed by the group.

The information in question

The facts state that internal files were exfiltrated in a ransomware attack. The group further claims the material comprises more than 84 GB of corporate documents, including NDAs, driver licences, passports, birth certificates, contact numbers and e-mail addresses of employees and customers, and financial data such as audits, payment details and reports. These categories are presented as the group's own description; they have not been independently verified in the public record.

Exact contents therefore remain unconfirmed. Organisations in the network-services sector commonly hold employee identity documents, customer contact and billing records, contractual NDAs, and financial reporting. Whether any or all of those categories were in fact taken in this incident is not established beyond the actor's claim. The number of individuals whose data may be involved is listed as unknown.

The real-world impact

If the claimed data were released or sold, affected employees and customers could face risks of identity misuse, targeted phishing, or financial fraud that rely on authentic personal details such as passport or licence numbers and contact information. Corporate financial records and NDAs, if genuine, could expose commercial relationships or payment practices to competitors or other adversaries. For Paratus itself, the listing creates reputational pressure and potential regulatory or contractual scrutiny, regardless of whether the full 84 GB claim is accurate.

Because the number of people affected is unknown and the precise data set is unconfirmed, the concrete scale of harm cannot yet be measured. Individuals whose details appear in any subsequent dumps would need to treat those records as compromised and take protective steps. The organisation faces the ordinary operational costs of investigation, customer notification where required, and system remediation—costs that remain undisclosed in the available facts.

Were you affected?

If you are an employee, customer, or partner of Paratus, monitor official statements from the company for any confirmation or guidance. Change passwords on related accounts, enable multi-factor authentication where available, and remain alert to unexpected messages that reference personal or financial details. Review bank and credit activity for unusual transactions. Readers can also run a free exposure scan of their email address to check whether their information has already surfaced in known breach data sets. Public detail on this incident remains limited; further verified information may emerge as investigations proceed.

AICompiled with AI assistance from public sources and published under our editorial standards.