Salton Listed by akira Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On June 24, 2024, the Brazilian winery Salton was listed by the ransomware group known as akira. Public reporting indicates that the group claims to have exfiltrated internal files in a ransomware attack and states that almost 30GB of data is to be released soon. The number of people affected remains unknown, and independent confirmation of the full scope is limited.

The listing matters because it involves a company that holds customer, employee and commercial records typical of a winery with visitor programs and international operations. Until more verified detail emerges, the claim itself is the primary public signal that sensitive material may have left the organisation’s control.

Inside the incident

According to the available record, Salton was named on akira’s leak site on or around June 24, 2024. The group asserts that internal files were taken during a ransomware attack and that nearly 30GB of material is prepared for release. No public timeline of the intrusion, no confirmed method of initial access, and no independent verification of the volume or exact contents have been released by Salton or by authorities. The number of individuals whose data may be involved is listed as unknown.

What is stated in the claim is that the material includes HR files containing personal data of Brazilian employees, together with agreements, contracts and financial data. Beyond that description, further technical or operational specifics remain undisclosed.

The group behind it: akira

Akira is a ransomware operation that became active in early 2023. It is known for double-extortion tactics: encrypting systems while also stealing data and threatening to publish it if a ransom is not paid. The group has targeted organisations across manufacturing, professional services, education and other sectors, typically using a combination of phishing, exploitation of remote-access tools and living-off-the-land techniques once inside a network. Its leak site has been used to pressure victims by listing company names and sample files.

In this case the group claims to hold almost 30GB of Salton material and to be preparing its release. That assertion is a claim made on the leak site; it has not been independently confirmed in the public record. No additional statements attributed specifically to akira about Salton’s systems or negotiations appear in the available facts.

Salton and its sector

Salton is a Brazilian winery that produces and markets wine and offers visitor experiences. Companies of this type ordinarily maintain customer-service records, booking and loyalty data for tastings and tours, supplier and distribution contracts, employee personnel files, and financial and accounting information. Because wine tourism and export markets involve both domestic and international contacts, the organisation may also hold passport or travel-related details for visitors and partners.

A breach affecting such an organisation is consequential because it can expose personal data of employees and customers, commercial agreements that competitors or fraudsters could exploit, and financial records that enable further targeting. Even when the precise scale is unconfirmed, the combination of HR, contractual and financial material raises practical risks for the people and counterparties whose information is held.

The information in question

The facts name the exposed material as internal files exfiltrated in a ransomware attack. The group’s listing further describes almost 30GB of data that includes HR files with personal data of Brazilian employees, agreements, contracts and financial data. No broader inventory of file types, no sample documents, and no confirmation of customer or visitor records have been published by independent sources.

Organisations in the wine and hospitality sector typically store employee identification and payroll data, customer contact and purchase histories, supplier contracts, and accounting ledgers. Whether any of those additional categories are present in the claimed 30GB set is unconfirmed. Readers should treat the exact contents as limited to what the group has asserted until further verified information appears.

What's at stake

For employees whose HR files may be involved, the concrete risks include identity theft, targeted phishing that references real employment details, and potential misuse of personal identifiers common in Brazilian records. For the company, exposure of contracts and financial data can facilitate business-email compromise, competitive intelligence gathering, or fraudulent invoicing. Customers or visitors whose information might later surface face similar social-engineering risks, although the public claim does not yet confirm their inclusion.

Because the number of affected individuals is unknown and the data volume is only claimed rather than independently measured, the full extent of harm cannot yet be quantified. The organisation itself faces operational disruption, potential regulatory scrutiny under Brazilian data-protection rules, and reputational pressure while it assesses the incident.

What to do if you're exposed

If you have worked for, contracted with, or visited Salton and believe your details may be among the claimed files, begin by monitoring bank and credit accounts for unusual activity and by treating unsolicited emails or calls that reference the company with caution. Change passwords on any accounts that reused credentials linked to work or visitor logins, and enable multi-factor authentication where available. Consider placing a fraud alert with credit bureaus if you are in a jurisdiction that offers that service.

You can also run a free exposure scan of your email address to check whether it has already appeared in known breach data sets. Keep records of any suspicious contact and report confirmed identity misuse to the appropriate local authorities. Further official statements from Salton or regulators, if they emerge, will provide the most reliable next steps.

AICompiled with AI assistance from public sources and published under our editorial standards.