Ransomware victim disclosure
← All victimsRiojamotor
listed as Rioja Motor · Claimed by Akira · listed 2 months ago
Status timeline
- Listed
Mar 23, 2026
- Data leaked
At a glance
About the victim
AI dossier — public-source company profileRiojamotor is a Spanish automotive dealership specialising in the sale of new and used vehicles across brands including Volkswagen, Audi, Seat, Skoda, and Cupra. The company also offers vehicle financing options and appraisal services, serving both personal and commercial clients. It operates in the La Rioja region of Spain.
- Industry
- Automotive Retail & Vehicle Sales
Attack summary
Severity: critical — The group claims exfiltration of regulated personal data at scale including government-issued identity documents, medical information, and client PII — all categories subject to GDPR and constituting a high-impact data breach affecting both employees and customers.Akira claims to have exfiltrated approximately 17 GB of corporate data from Riojamotor, including employee personal information (passports, IDs, addresses, emails), medical information, client personal documents, financial records, project files, and correspondence, with publication of the data described as imminent.
Data the group says was taken
AI dossier — extracted from the leak post- Employee passports and ID documents
- Employee addresses and emails
- Employee medical information
- Client personal documents
- Financial records
- Project files
- Corporate correspondence
What the group claims
Riojamotor specializes in the sale of new and used vehicles, incl uding brands such as Volkswagen, Audi, Seat, Skoda, and Cupra. Th ey offer financing options and vehicle appraisal services, cateri ng to clients looking for both personal and commercial vehicles. We will upload 17gb of corporate data soon. Employee personal inf ormation (passports, IDs, address, emails and so on), medical inf ormation, client personal docs, financials, lots of projects, cor respondence, etc.
Source
Indexed 2 months agoThis page surfaces a public ransomware disclosure indexed by Darkfield. Original posts come from the operator's own leak site; we cross-check against ransomware.live, RansomLook and RansomWatch where applicable. Share this URL freely.
