Permoda Listed by akira Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Permoda, a retail textiles company operating under the KOAJ brand across several Latin American countries, was listed by the Akira ransomware group on or around 9 January 2025. Public reporting indicates that internal files were exfiltrated in a ransomware attack, though the number of people affected remains unknown and independent confirmation of the full scope is limited.

The listing itself is a claim by the group, which stated it was prepared to release more than 220 GB of private corporate documents. For customers, employees and partners of Permoda, the incident raises practical questions about what information may have left the organisation and what steps can reduce any resulting risk.

What happened

According to available reports dated 9 January 2025, the Akira ransomware group listed Permoda on its leak site. The organisation is described as a leading company in the retail industry specialising in the production, manufacturing and distribution of textiles sold through the KOAJ brand, with operations in Colombia, Costa Rica, Ecuador and Panama. The group claimed that internal files had been exfiltrated and that it was ready to upload more than 220 GB of private corporate documents. Exact timing of the intrusion, the technical method used, and any ransom demand or payment status have not been publicly disclosed. The number of individuals affected is listed as unknown.

Inside akira

Akira is a ransomware group that has been active since early 2023. It typically operates a double-extortion model: encrypting systems while also stealing data and threatening to publish it on a dedicated leak site if a ransom is not paid. The group has targeted organisations across multiple sectors, including manufacturing, professional services and retail, often gaining initial access through compromised credentials, phishing or unpatched remote-access services. Once inside a network, Akira operators commonly move laterally, disable security tools, exfiltrate large volumes of data and then deploy ransomware. Listings on its leak site are claims made by the group; they do not by themselves constitute independent verification that every asserted detail is accurate or that the data has been released.

In this case, the group’s public statement regarding Permoda asserts readiness to publish more than 220 GB of material. No further verified statements from Akira specifically about this victim beyond that listing and claim have been reported in the available facts.

About Permoda

Permoda is a retail-industry company focused on textiles. It handles production, manufacturing and distribution and sells products under the KOAJ brand. Its geographic footprint covers Colombia, Costa Rica, Ecuador and Panama. Organisations of this type routinely maintain employee records, customer contact details, supplier and distributor contracts, financial documentation, quality and certification papers, and operational data needed to run manufacturing and retail channels. A breach involving such an organisation can therefore touch both internal staff and external customers or partners across multiple countries.

Because the company operates in consumer-facing retail and supply-chain activities, any compromise of its systems carries potential consequences for commercial relationships, regulatory obligations in the jurisdictions where it is present, and the personal information of people who interact with the KOAJ brand.

What was likely exposed

Public facts state that internal files were exfiltrated in a ransomware attack. The Akira group claims the volume exceeds 220 GB and that the material includes contact numbers and e-mail addresses of employees and customers, internal financial documents, confidential agreements and contracts, and certification documents. These categories are presented as the group’s assertions; independent confirmation of the precise contents, completeness or accuracy of the claimed data set has not been provided in the available reporting. The exact number of records or individuals involved remains undisclosed.

Companies in textile manufacturing and multi-country retail distribution typically hold employee contact and payroll-related information, customer purchase and contact data, supplier contracts, financial statements, quality certifications and internal operational files. Whether any or all of those categories were present in the claimed 220 GB archive cannot be verified from the public facts alone.

Why it matters

If the claimed data were released or sold, employees and customers could face increased risk of phishing, social-engineering attempts or identity-related fraud that use accurate contact details and organisational context. Confidential commercial agreements and financial documents, if authentic, could expose pricing, supplier terms or other sensitive business information to competitors or other third parties. Certification documents might be misused or create compliance complications.

For Permoda itself, the incident can affect operational continuity, customer trust and contractual relationships across the four countries in which it operates. Because the number of people affected is unknown and the precise data set unconfirmed, the full scale of individual impact cannot yet be quantified. The listing by a ransomware group that specialises in data theft nonetheless signals a concrete exposure event that warrants attention from anyone who has shared personal or commercial information with the company.

If your data was in this claimed breach

If you are a current or former employee, customer or partner of Permoda or the KOAJ brand, treat the possibility of exposure seriously even while exact contents remain unconfirmed. Change passwords on any accounts that may have used the same credentials, enable multi-factor authentication where available, and watch for unexpected emails or calls that reference company details. Monitor financial accounts and credit reports for unusual activity. Consider placing fraud alerts with relevant credit bureaus in your country if you believe sensitive personal information may have been involved.

You can also run a free exposure scan of your email address to check whether it has already appeared in known breach data sets. Stay alert for official statements from Permoda that may provide further Reported Details, and avoid clicking links or opening attachments in unsolicited messages that claim to relate to this incident.

AICompiled with AI assistance from public sources and published under our editorial standards.