Perfumes & Companhia Listed by akira Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

People who have shopped with, worked for, or done business with Perfumes & Companhia may now face the practical risk that internal company files have been taken and could soon appear online. Public reporting on 19 June 2024 states that the Akira ransomware group has listed the Portuguese cosmetics firm and claims 25 GB of data will be released. The number of individuals affected remains unknown, and the precise contents of the files have not been independently confirmed.

For ordinary customers, staff and partners, the immediate concern is whether personal or commercial details held by the company could be misused for fraud, phishing or identity-related harm once any material becomes public. Detail beyond the group’s claim is limited.

Breaking down the breach

According to the available record, Perfumes & Companhia was listed by the Akira ransomware group on or around 19 June 2024. The group asserts that internal files were exfiltrated during a ransomware attack and that 25 GB of data “will go public soon.” No independent confirmation of the intrusion method, the exact date of compromise, or the full scope of systems affected has been published in the facts provided. The number of people whose information may be involved is listed as unknown. Public detail on whether a ransom was demanded or paid is also undisclosed.

What is stated is simply that the organisation appears on the group’s leak site with a claim of forthcoming data release. Until further verified information emerges, the listing itself remains an unverified claim by the threat actor.

Who is akira?

Akira is a ransomware operation that became publicly active in 2023. Like many contemporary groups, it typically employs a double-extortion model: encrypting systems while also stealing data and threatening to publish it if payment is not made. The group has been observed targeting organisations across multiple sectors and geographies, often gaining initial access through compromised credentials, exposed remote services or known vulnerabilities, then moving laterally to locate and exfiltrate files before deploying encryption.

Akira maintains a leak site where it posts victim names and, in some cases, sample data or full archives. Listings on that site are claims made by the group; they do not automatically constitute independent verification that every asserted detail is accurate. In this instance the facts record only that Perfumes & Companhia has been named and that 25 GB of data is said to be pending release. No further statements attributed specifically to this victim appear in the provided record.

Perfumes & Companhia and its sector

Perfumes & Companhia is described as a company operating in the cosmetics industry, headquartered in Lisbon, Portugal. It is reported to employ between 501 and 1,000 people and to generate roughly $500 million in revenue. Organisations of this size and type typically manage customer purchase records, loyalty or account data, employee information, supplier contracts, and internal operational documents.

A breach involving a mid-sized cosmetics retailer or distributor can affect a wide circle of people: retail customers who have provided contact or payment details, employees whose HR files are held, and business partners whose commercial terms appear in internal systems. Because the company sits at the intersection of consumer retail and wholesale supply chains, the potential reach of any exposed material extends beyond a single office or store.

The information in question

The facts state that “internal files” were exfiltrated in a ransomware attack. No further breakdown of data types—such as customer names, email addresses, payment card numbers, employee records or financial documents—has been disclosed. Exact contents therefore remain unconfirmed.

Companies in the cosmetics sector commonly hold customer account information, order histories, marketing lists, employee personal data, and commercial correspondence. Whether any of those categories are present in the claimed 25 GB archive is not established by the public record. Readers should treat the volume figure and the “internal files” description as the group’s claim rather than verified inventory.

Why it matters

If the claimed data is released, individuals whose details appear could face targeted phishing, credential stuffing, or social-engineering attempts that reference real company relationships. Employees might see personal or payroll-related information surface; customers might receive convincing fraudulent messages that appear to come from Perfumes & Companhia. For the organisation itself, publication of internal files can disrupt operations, damage commercial relationships and create regulatory notification obligations under European data-protection rules.

Because the number of people affected is unknown and the precise data types are undisclosed, the scale of real-world harm cannot yet be quantified. The practical risk, however, is concrete: once material is public, it can be copied, sold or reused long after any initial news cycle ends.

What to do if you're exposed

If you have a relationship with Perfumes & Companhia—as a customer, employee or supplier—consider the following practical steps while further detail remains limited:

• Monitor bank and card statements for unfamiliar transactions and enable transaction alerts where available.
• Treat unsolicited emails, calls or messages that reference the company or recent purchases with caution; verify through official channels before clicking links or providing information.
• Change passwords for any accounts that reuse credentials also used with the company, and enable multi-factor authentication where offered.
• Review credit reports or equivalent free services in your country for unexpected new accounts or enquiries.
• Run a free exposure scan of your email address against known breach data sets to see whether your details have already appeared in other incidents.

Public information about this incident is still incomplete. Continue to rely on official statements from the company or competent authorities rather than unverified claims circulating online.

AICompiled with AI assistance from public sources and published under our editorial standards.