Selenis (Evertis) Listed by akira Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to target industrial and manufacturing firms, using data theft and public leak threats to pressure victims. In this landscape, listings on criminal leak sites have become a common early signal that an organisation may have suffered a breach, even when independent confirmation is still limited.

On 22 April 2025, the ransomware group known as akira listed Selenis (Evertis) among its claimed victims. Public detail remains sparse: the number of people affected is unknown, and the precise method and timing of any intrusion have not been independently verified. The listing itself is a claim by the group that it exfiltrated internal files. For customers, partners and employees of a polymers supplier that handles sensitive commercial and personal records, the appearance of such a claim is reason for careful attention rather than panic.

What happened

According to the available record, Selenis (Evertis) was listed by the akira ransomware group on 22 April 2025. The report characterises the incident as a ransomware attack in which internal files were allegedly exfiltrated. No confirmed figure for the number of people affected has been published, and no independent forensic timeline or technical description of the intrusion has been released in the public summary.

The group’s own statement on its leak site asserts that it will upload more than 70 GB of corporate documents. That statement is an unverified claim by the attackers; it has not been corroborated by the organisation or by third-party investigators in the material provided. Beyond the listing date and the characterisation of the data as internal files taken in a ransomware attack, further operational details remain undisclosed.

Who is akira?

Akira is a well-documented ransomware operation that emerged in public reporting in 2023 and has since conducted double-extortion campaigns against organisations across multiple sectors. Typical tactics include initial access through compromised credentials or vulnerable remote services, followed by lateral movement, data theft and encryption of systems. The group commonly posts victim names and sample files on a dedicated leak site to increase pressure for payment, and it has previously claimed attacks on manufacturing, professional services and industrial firms.

In this case, the only specific assertion tied to Selenis (Evertis) is the group’s own listing and its description of the volume and categories of files it says it holds. Those statements should be treated as claims until independently confirmed. No additional public statements by akira about this particular victim appear in the record beyond the leak-site posting summarised above.

About Selenis (Evertis)

Selenis is described as part of the IMG Group, a family-owned multinational with a presence in the polymers industry since 1959. The company positions itself as a premium supplier of innovative copolyesters used in a diverse range of applications. Organisations of this type routinely manage commercial contracts, technical specifications, customer and supplier records, and internal financial and legal documentation.

Because Selenis operates in a specialised industrial supply chain, a breach can affect not only its own workforce but also downstream customers who rely on its materials and the personal or commercial data those relationships generate. The public summary does not indicate whether the company has issued its own confirmation or notification; the sole source of the incident report is the akira listing.

What was likely exposed

The factual record states that internal files were exfiltrated in a ransomware attack. The attackers further claim that the material exceeds 70 GB and includes detailed client personal information and documents (passports, medical records, drivers licences), confidential court files, financial data of clients, NDAs and other essential corporate documents. These categories are presented solely as the group’s assertion; they have not been independently verified in the available information.

Exact contents, file counts and the identities of any affected individuals therefore remain unconfirmed. Companies in the polymers and specialty-chemicals sector typically hold customer contact and contract data, shipping and quality records, employee information, financial ledgers and legal agreements. Whether any of those categories were in fact taken cannot be established from the public listing alone.

Why it matters

If the attackers’ claims prove accurate, individuals whose identity documents, medical records or financial details appear in the stolen set could face risks of identity fraud, targeted phishing or unauthorised use of personal data. Corporate clients could see confidential commercial terms or litigation materials exposed, creating competitive or legal exposure. For Selenis itself, the incident raises operational, regulatory and reputational considerations common to any organisation that loses control of internal files, regardless of whether a ransom is paid.

Because the number of people affected is unknown and the precise data set is unconfirmed, the practical impact cannot yet be quantified. The value of early awareness lies in allowing potentially affected parties to monitor accounts and documents rather than in assuming the worst-case scenario has already materialised.

What to do if you're exposed

Anyone who has done business with Selenis (Evertis) or believes their personal or corporate data may have been held by the company should treat the listing as a prompt for basic hygiene: review bank and credit statements for unexpected activity, enable multi-factor authentication on important accounts, and be alert to phishing messages that reference the company or recent transactions. If identity documents are among the materials the attackers claim to hold, consider placing fraud alerts with relevant credit agencies where available.

Readers can also run a free exposure scan of their email address to check whether that address has already appeared in known breach data sets. Such a check does not confirm or rule out involvement in this specific incident, but it provides a practical starting point for assessing wider exposure. Official notifications from Selenis or from regulators, if and when they appear, should take precedence over unverified claims circulating on leak sites.

AICompiled with AI assistance from public sources and published under our editorial standards.