Pyrénées Listed by akira Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to target retail and consumer-facing organisations across Europe, using data theft alongside encryption to pressure victims. On 18 March 2026 the Akira ransomware group listed Pyrénées on its leak site, claiming to have stolen internal files from the Andorran retailer Grans Magatzems Pyrénées Andorra. The number of people affected remains unknown and no independent confirmation of the data volume or contents has been made public.

Inside the incident

The incident came to light when Akira posted Pyrénées on its data-leak site. The group stated it would publish 263 GB of corporate data, describing the material as employee passports and driving licences, HR forms, financial records, client information, contracts, agreements and NDAs. No date of intrusion, encryption method or ransom demand has been disclosed. The organisation has not issued a public statement confirming or denying the claims.

Who is akira?

Akira is a ransomware operation that emerged in early 2023 and has since conducted campaigns against organisations in multiple countries. Public reporting shows the group typically uses double-extortion tactics: encrypting systems and exfiltrating data before threatening to publish the material if payment is not received. It maintains a leak site to list victims and has been linked to attacks on entities in manufacturing, legal services and critical infrastructure. Attribution in any single case rests on the group’s own claims unless corroborated by law-enforcement or forensic findings.

Pyrénées and its sector

Pyrénées operates department stores and related services in Andorra, selling food, fashion, sports equipment and technology while also providing online shopping, dining, travel-agency and financial services. Retailers of this type routinely process customer payment details, loyalty-programme records, supplier contracts and employee documentation. A breach at such an organisation can expose both personal customer data and internal business records that reveal commercial relationships and operational practices.

What was likely exposed

The Akira listing describes internal corporate files that were allegedly removed from Pyrénées systems. The exact scope and sensitivity of the material remain unconfirmed by the organisation or by independent investigators.

• Employee passports and driving licences
• HR forms
• Financial records
• Client information
• Contracts, agreements and NDAs

What's at stake

Individuals named in the claimed files could face risks of identity misuse or targeted fraud if the documents contain passport numbers, addresses or financial identifiers. The organisation may encounter regulatory scrutiny under Andorran or EU-adjacent data-protection rules and could face operational disruption if systems were encrypted. Long-term consequences depend on whether the data is published, how it is used and what mitigation steps are taken by affected parties.

What to do if you're exposed

Anyone who believes their information may be involved should monitor bank and credit accounts for unusual activity, place fraud alerts with credit bureaus where available, and consider changing passwords for any accounts linked to the organisation. Readers can run a free exposure scan of their email address against known breach data to check for prior appearances of their information. Organisations should follow official incident-reporting channels and consult data-protection authorities as required by local law.

AICompiled with AI assistance from public sources and published under our editorial standards.