Akira ransomware group claims data breach against TOGA

• Ransomware group: Akira
• Country: Australia
• Sector: Retail & E-Commerce
• Announcement date: March 26, 2025

Akira ransomware group claims data breach against TOGA

A data leak announcement has been published by the Akira ransomware group targeting the real estate development company TOGA. According to the claim made on the group's leak site, the attackers have successfully exfiltrated a significant volume of corporate information, marking a potential security incident for the Australian-based firm.

Details of the alleged attack

The Akira ransomware group has listed over 530 GB of data on their leak site, claiming it belongs to TOGA. The announcement was made on March 26, 2025, suggesting that the company's corporate and operational data may be at risk. The group alleges that the stolen information includes sensitive financial documents and contact information.

Ransomware groups often employ a method known as double extortion. In this scenario, attackers do not merely encrypt a victim's systems to disrupt operations; they also steal sensitive data before the encryption process begins. The threat of leaking this stolen information on a public leak site serves as additional leverage to pressure the victim into paying a ransom. This method increases the pressure on organizations, as the threat shifts from operational downtime to the public exposure of confidential data.

Claimed data types and contents

While no screenshot has been provided to verify the contents of the leak, the announcement claims that various categories of sensitive information have been exfiltrated. The group asserts that the stolen data includes:

• Financial data
• Audit reports
• Payment details
• Employee contact information
• Customer contact information
• Database files

The presence of such diverse data types suggests that the breach could impact multiple departments within the organization, ranging from human resources and customer service to finance and IT administration.

About TOGA

TOGA is an Australian-based real estate development company specializing in residential, commercial, hotel, and retail projects. The company focuses on urban renewal and mixed-use developments.

Potential impact and security considerations

This alleged data breach may pose secondary risks such as identity theft and targeted phishing attacks for employees and customers. The exposure of corporate data could negatively impact the company's business operations and may trigger legal proceedings under Australian data protection regulations. Given the Akira group's double-extortion method, the publication of this data could lead to significant reputational damage.

Information about this group is limited; however, as they are known to exploit VPN vulnerabilities in similar attacks, this situation may necessitate a review of the organization's network security protocols. Organizations facing similar threats often prioritize the hardening of remote access points and the implementation of multi-factor authentication to mitigate the risk of unauthorized entry.

In the retail and development sectors, protecting sensitive client and financial information is critical to maintaining trust. When data is exfiltrated, the risk extends beyond the immediate technical impact to include long-term consequences for stakeholder relationships and regulatory compliance. Organizations typically respond to such threats by conducting forensic investigations to determine the scope of the breach and reviewing their defensive posture to prevent future unauthorized access to sensitive databases and communication channels.