Selenis (Evertis is also involved) Listed by akira Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to pressure organisations by combining encryption with the threat of public data leaks, turning corporate networks into leverage against both companies and the people whose information they hold. In this climate, listings on criminal leak sites have become a common early signal that an organisation may have been compromised, even when independent confirmation remains limited.

On 8 May 2025, the ransomware group known as akira listed Selenis — with Evertis also named as involved — among its claimed victims. Public detail is limited: the number of people affected is unknown, and the only confirmed description of what was taken is that internal files were allegedly exfiltrated in a ransomware attack. The group has claimed it intends to publish more than 70 GB of corporate material. For anyone whose personal or business data may have been held by these companies, the listing raises practical questions about exposure and next steps.

Breaking down the breach

What is publicly recorded is that Selenis (with Evertis also involved) appeared on an akira leak site on or around 8 May 2025. The incident is characterised as a ransomware attack in which internal files were allegedly exfiltrated. No independent confirmation of the intrusion method, the exact date of initial access, the duration of the attackers’ presence, or the total volume of data taken has been provided in the available record. The number of individuals affected remains unknown.

Akira’s listing includes a claim that the group will upload more than 70 GB of “essential corporate documents,” which it describes as including detailed client personal information and documents such as passports, medical records and drivers’ licences, confidential court files, financial data of clients, NDAs and similar material. These assertions come from the threat actor and have not been independently verified in the facts available. Beyond the statement that internal files were allegedly exfiltrated, further technical or forensic detail about the breach itself has not been disclosed.

The group behind it: akira

Akira is a ransomware operation that has been active in recent years and is known for a double-extortion model: encrypting systems while also stealing data and threatening to publish it if a ransom is not paid. The group typically advertises victims on a dedicated leak site, often with sample files or volume claims intended to increase pressure. Public reporting on akira has associated it with attacks across multiple sectors, including manufacturing, professional services and other mid-sized and larger organisations, frequently using common initial-access techniques such as compromised credentials or unpatched remote services, though the specific vector in any given case is not always published.

In this instance, the group’s listing of Selenis (and the mention of Evertis) should be treated as an unverified claim. The description of the planned 70 GB release and the categories of documents named are likewise statements made by the group, not independently confirmed findings. No further statements attributed to akira about this specific victim appear in the available facts.

About Selenis (Evertis is also involved)

According to the reported summary, Selenis is part of the IMG Group, a family-owned multinational with a presence in the polymers industry since 1959. Selenis is described as a premium supplier of innovative copolyesters for a diverse range of applications. Evertis is named alongside Selenis in the listing; public detail on the precise corporate relationship in this incident is limited beyond that joint mention.

Organisations in the specialty polymers and materials sector typically hold a mix of commercial, technical and personal data: customer and supplier contracts, product specifications, financial records, employee information, and sometimes identity or compliance documents related to clients or partners. A breach at such a company can therefore affect not only the business itself but also customers, suppliers and individuals whose documents were stored for commercial or legal purposes. Because the companies operate internationally within a long-established industrial group, the potential reach of any compromised data is not confined to a single country or small set of contacts.

What was likely exposed

The facts state that internal files were exfiltrated in a ransomware attack. The threat actor claims the material includes more than 70 GB of corporate documents encompassing detailed client personal information and documents (passports, medical records, drivers’ licences), confidential court files, financial data of clients, NDAs and similar items. These categories are presented as the group’s description of what it holds; they have not been independently verified in the available record.

Exact contents, file counts and the identities of any affected individuals remain unconfirmed. Organisations of this type commonly store commercial contracts, financial records, employee data and, in some cases, identity or legal documents supplied by clients. Whether any of those typical holdings were among the files taken in this incident cannot be established from the public facts alone. Readers should treat the group’s list of document types as a claim rather than as confirmed inventory.

The real-world impact

If personal identity documents, medical records, financial data or court-related files were among the material taken, affected individuals could face risks of identity fraud, targeted phishing, or misuse of sensitive personal information. Even where only business documents were involved, the exposure of NDAs, client financials or legal files can create commercial harm, contractual complications and reputational damage for the companies and their partners.

For Selenis and Evertis, the combination of a ransomware incident and a public leak-site listing typically means operational disruption, investigation and recovery costs, possible regulatory scrutiny depending on jurisdiction and data types, and the need to notify customers or partners if personal data was involved. Because the number of people affected is unknown and the precise contents unconfirmed, the scale of individual harm cannot yet be quantified. The primary practical concern for people who have dealt with these organisations is whether their own documents or contact details were among the internal files that were taken.

If your data was in this claimed breach

If you have been a client, employee, supplier or other contact of Selenis or Evertis, treat the possibility of exposure seriously even while exact details remain limited. Monitor financial accounts and credit reports for unusual activity, be alert to phishing or social-engineering attempts that reference the companies or your past dealings with them, and consider placing fraud alerts if you believe identity documents may have been involved. Change passwords on any accounts that reused credentials linked to these organisations, and enable multi-factor authentication where available.

You can also run a free exposure scan of your email address to check whether your information has already appeared in known breach datasets. Keep records of any official notifications you receive from the companies, and follow guidance from relevant data-protection authorities if formal notices are issued. Public detail on this incident remains incomplete; further confirmed information, if it emerges, will provide a clearer picture of who was affected and what steps are most appropriate.

AICompiled with AI assistance from public sources and published under our editorial standards.