Akira ransomware group claims data breach against HOERBIGER Holding

• Ransomware group: Akira
• Country: Switzerland
• Sector: Manufacturing
• Announcement date: August 21, 2024

Akira ransomware group claims data breach against HOERBIGER Holding

The Akira ransomware group has claimed responsibility for a cyberattack targeting HOERBIGER Holding. According to an announcement made on August 21, 2024, the threat actor group alleges that they have successfully exfiltrated 50 GB of data belonging to the organization and has indicated that this information will be released soon.

Details of the claimed ransomware incident

The Akira group has reported a ransomware incident involving HOERBIGER Holding, stating that a data leak has occurred. The group has reportedly listed the victim's data for upcoming release on their leak site. While the group has made these claims, public information regarding the specific operations and background of the Akira group remains limited.

Ransomware attacks of this nature often involve a process known as double extortion. In a double extortion scheme, attackers do not merely encrypt an organization's systems to disrupt operations; they also steal sensitive information before the encryption occurs. The attackers then threaten to leak the stolen data on public forums or leak sites if the ransom demand is not met. This tactic significantly increases the pressure on the victim, as the threat of exposing confidential information can cause lasting reputational and legal damage even if the organization can restore its systems from backups.

Claimed sensitive data types

The data allegedly stolen by the Akira group is claimed to include a wide variety of sensitive information. The contents of the exfiltrated data are reported to consist of the following:

• Employee personal information
• Client and customer information
• Confidential agreements
• Contracts
• NDAs
• Medical files
• Accounting and financial data

The specific details regarding the exact number of files stolen or the specific amount of a ransom demand have not been provided in the announcement.

About HOERBIGER Holding

HOERBIGER Holding is a global technology company that manufactures high-performance components and systems for compressor technology, automotive, and industrial applications. Headquartered in Switzerland, the firm provides critical engineering solutions for the energy, industrial, and transportation sectors.

Potential impact and organizational risks

The nature of the data claimed to be exfiltrated poses significant operational and financial risks to the organization. The leakage of personal and medical files could potentially trigger legal proceedings under relevant regulations, such as the General Data Protection Regulation (GDPR), which governs the handling of personal data. Furthermore, the type of data involved may lead to secondary risks, including targeted phishing campaigns or identity theft, as attackers can use the stolen information to impersonate employees or clients.

When an organization faces a complex crisis management process due to double extortion, several defensive and reactive steps are typically considered in the cybersecurity industry. Organizations often focus on strengthening their perimeter defenses, implementing robust multi-factor authentication, and maintaining rigorous patch management to prevent initial access. Additionally, maintaining offline, immutable backups is a critical component of a modern defense-in-depth strategy to mitigate the impact of encryption-based ransomware.

In the event of a confirmed data breach, organizations often must engage in comprehensive forensic investigations to determine the scope of the intrusion. They may also need to implement enhanced monitoring to detect further unauthorized movement within the network. Because the leakage of sensitive documents like NDAs and contracts can impact business relationships, managing the communication and legal implications becomes a vital part of the incident response lifecycle.