Ondunova Listed by akira Ransomware Group

On January 21, 2025, Spanish packaging manufacturer Ondunova appeared on the leak site of the Akira ransomware group. The attackers claim to have exfiltrated more than 31 GB of internal documents, including NDAs, financial audits, payment details, reports, internal emails, contact numbers, and addresses belonging to employees and customers.

Reported Details of the Incident

Public reporting indicates that Ondunova, together with its sister company Wondu, forms one of Catalonia’s largest corrugated cardboard packaging groups. The two companies operate production centers in Santa Margarida i Els Monjos near Barcelona. The Akira group posted screenshots and a description stating they are prepared to publish the full cache of stolen files unless their demands are met.

More than 31 GB of corporate records are said to be ready for release. The exposed material includes sensitive business contracts, financial records, employee contact information, and customer details. No confirmed victim count has been released, and it remains unclear exactly how many individuals or businesses had personal data included in the exfiltrated files.

Why This Matters for You and Your Family

When a company that handles everyday business transactions suffers a breach, your personal information can end up in the hands of criminals even if you never directly used their services. If you or anyone in your household has worked with Ondunova, supplied materials to them, or been listed as a customer or vendor, your name, email address, phone number, or financial references may now be circulating among threat actors.

Employee and customer contact data is particularly valuable because it can be used to launch targeted phishing attacks, identity theft attempts, or harassment campaigns. For families, a single exposed work email or phone number can quickly link to personal accounts, social-media profiles, and even children’s online activities.

The Doxxing and Identity-Chain Risks

Stolen corporate directories rarely stay isolated. Attackers routinely combine employee and customer lists with other leaked datasets to build detailed profiles. A phone number from this claimed breach can be cross-referenced with gaming usernames, family addresses, or spouse names found in earlier leaks, creating a chain that leads to doxxing or account takeovers.

Credential leaks like this one frequently cascade into gaming account compromises. Children’s usernames or parent-linked emails exposed in corporate data can be tested against popular game platforms, turning a business breach into a household privacy incident. Once initial footholds are gained, attackers use them to demand ransoms or sell the information on underground forums.

Akira Ransomware Group’s Track Record

Public reporting attributes the attack to the Akira ransomware group, which first emerged in 2023. The group has targeted organizations across multiple countries and industries, often focusing on mid-sized manufacturing and service firms. Notable prior victims include healthcare providers, technology companies, and logistics operators.

Akira’s typical playbook involves gaining initial access through compromised credentials or remote desktop vulnerabilities, exfiltrating data before encrypting systems, and then pressuring victims with dual extortion: threats to publish stolen files combined with demands for payment to restore encrypted infrastructure. The group maintains an active leak site where it posts samples and deadlines if ransoms are not paid.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real-world identity so you can see exactly what chains back to the Ondunova breach.
• Rotate any password you have used at Ondunova or related business accounts anywhere it is reused, and switch on two-factor authentication through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next time your information surfaces you learn within hours rather than months.
• Cover the household with DoxxScan family protection that extends to dependents and children’s gaming accounts, which often become targets when corporate contact details create doxxing chains.
• Let remediation specialists handle takedown requests across data brokers and leak sites while you focus on securing your own accounts and those of your family.

The Ondunova breach is a reminder that corporate leaks quickly become personal when names, phones, and emails escape into the wild. Taking concrete steps now limits how far attackers can travel down the identity chain. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that includes children’s gaming accounts. Start your DoxxScan trial today to regain control of your exposed information before the next wave of abuse begins.