360energy.com.ar listed on Akira ransomware leak site

• Ransomware group: Akira
• Country: Argentina
• Sector: Energy & Utilities
• Announcement date: February 4, 2025

The Akira ransomware group has officially listed the Argentinian organization 360energy.com.ar on its dedicated leak site. This announcement, made on February 4, 2025, indicates that the threat actor group claims to have successfully gained access to the organization's internal data.

Details of the claim

According to the announcement posted by the Akira group, the listing of 360energy.com.ar occurred on February 4, 2025, which coincides with the date the group claims to have carried out the attack. While the group has publicly identified the target, the announcement remains limited in scope regarding the specifics of the breach. Notably, the group has not provided any information regarding a ransom demand, nor have they disclosed the total size of the data they claim to have obtained.

Ransomware leak sites serve as a platform for cybercriminal groups to pressure victims into paying ransoms by threatening to release sensitive information. These sites often host countdown timers or lists of victims to increase psychological pressure. In this specific instance, the group has asserted their access to the network, but they have not provided any screenshots or further documentation to verify the nature of the files they claim to possess.

Data involvement and specifics

At this stage of the incident, there is no information or screenshot available regarding the specific nature of the data leaked on the site. The listing does not specify which types of files were targeted or accessed during the alleged intrusion. Furthermore, the announcement does not provide any details regarding the volume of the data or the specific file count involved in the breach.

Organization profile

360Energy is an organization based in Argentina that operates within the renewable energy sector. The company focuses on the development, construction, and operation of various solar energy projects. Through its specialized activities, 360Energy provides sustainable energy solutions to its clients via solar power plants.

Risk assessment and industry implications

Because the Akira group is known to operate using a double-extortion model, there is a significant risk that the organization's data may be published on the dark web. In a double-extortion scenario, attackers do not just encrypt files to disrupt operations; they also steal sensitive data to use as leverage, threatening to leak it if the ransom is not met. This adds a layer of complexity to incident response, as the threat of data exposure remains even if systems are restored from backups.

The energy sector is frequently categorized as critical infrastructure. Consequently, an attack on a company like 360Energy could pose potential risks to operational continuity. If a data breach is confirmed, the exposure of sensitive information—such as employee or customer data—could lead to secondary risks, including the possibility of identity theft.

The Akira group has historically been known to exploit vulnerabilities in Virtual Private Networks (VPNs) to gain initial access to corporate networks. This highlights a common vector for modern ransomware attacks. Organizations operating in critical sectors may need to review their security measures against such vectors, focusing on robust access controls and vulnerability management. The ultimate severity of this incident will depend heavily on the specific nature and sensitivity of the compromised data once more information becomes available.