Texollini Listed by akira Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware operations continue to target manufacturing and industrial firms, where operational data and employee records can create leverage for extortion. On February 18, 2026, the Akira ransomware group listed Texollini on its leak site, claiming to have exfiltrated internal files during a ransomware attack. The number of people affected remains unknown, and the organization has not issued a public statement confirming the incident or its scope.

What happened

The listing states that Texollini was compromised in a ransomware attack and that internal files were removed. The group claims it will publish approximately 20 GB of corporate data, describing categories that include employee passports and driver’s licenses, medical records, HR forms, financial files, some client files, contracts, agreements, and NDAs. No independent confirmation of the data volume, the encryption of systems, or the timeline of the intrusion has been made public. The exact method of initial access and the duration of unauthorized access are not disclosed in the available information.

Inside akira

Akira is a ransomware group that has operated since 2023 and is known for double-extortion tactics: encrypting victim systems while also copying data for later publication. The group maintains a leak site where it lists organizations and threatens to release stolen files if ransom demands are not met. Public reporting has documented Akira’s activity against companies in manufacturing, construction, and professional services, though each incident requires separate verification. In this case the listing of Texollini constitutes the group’s claim; no additional statements attributed to Akira about this specific victim have been confirmed beyond the posted description.

About Texollini

Texollini is a textile manufacturer that develops performance fabrics by combining traditional textile production with technical processes. Its product lines include activewear, athleisure, swimwear, and intimate apparel supplied to multiple markets. Organizations of this type routinely maintain records on employees, suppliers, and product development, along with contracts and regulatory documentation. A compromise at such a firm can expose both operational information and personal data belonging to staff and business partners.

What was likely exposed

The only confirmed detail is that internal files were removed during a ransomware attack. The Akira listing claims the forthcoming 20 GB release will contain employee passports, driver’s licenses, medical records, HR forms, financial files, limited client files, contracts, agreements, and NDAs. Because the data have not yet been published and no forensic report from Texollini is available, the precise contents and completeness of any dataset remain unconfirmed. Typical records held by a textile manufacturer would include personnel files and commercial agreements, but the exact categories and volume cannot be stated as established fact.

The real-world impact

Individuals whose passports, driver’s licenses, or medical information appear in the claimed dataset could face risks of identity misuse or targeted fraud. Contracts and financial files could reveal pricing, supplier terms, or internal cost structures that competitors might exploit. For the organization, the incident adds operational disruption from any encryption that occurred and potential regulatory scrutiny over the handling of employee and client information. The absence of a confirmed count of affected individuals makes it difficult to assess the full scale of personal exposure at this stage.

What to do if you're exposed

Anyone who has worked with or for Texollini should monitor their financial accounts and credit reports for unusual activity. Replacing government-issued identification documents may be warranted if passport or driver’s license details are confirmed as compromised. Organizations that receive services from Texollini should review any shared contracts or data for signs of misuse. Individuals can run a free exposure scan of their email address against known breach datasets to determine whether their information has appeared in previously published collections.

AICompiled with AI assistance from public sources and published under our editorial standards.