Akira ransomware group claims data leak involving Paratus

• Ransomware group: Akira
• Country: Namibia
• Sector: Technology
• Announcement date: February 21, 2025

Akira ransomware group claims data leak involving Paratus

The Akira ransomware group has claimed a data leak involving the technology firm Paratus. According to an announcement made on a leak site, the group asserts that they have obtained a significant amount of data belonging to the organization. This claim was published on February 21, 2025, and aligns with the date the group allegedly conducted the attack.

Details of the alleged data breach

The Akira ransomware group has listed over 84 GB of data allegedly belonging to Paratus on their leak site. The group claims that the data includes various corporate documents. While the group has made this claim, information regarding this specific group remains limited. It is important to note that no screenshot has been provided to substantiate the claims made in the announcement.

According to the announcement, the data allegedly includes a wide variety of sensitive information. The types of data mentioned in the claim include:

• Non-disclosure agreements (NDAs)
• Driver licenses
• Passports
• Birth certificates
• Contact information of employees and customers
• Financial data (audits, payment details, reports)

About Paratus

Paratus is a telecommunications company providing integrated network services, data center, and connectivity solutions across Africa. The company invests in infrastructure to deliver digital network services throughout the continent.

Impact and analysis of the claim

The nature of the allegedly leaked data may increase the risk of identity theft and targeted phishing attacks for employees and customers. The disclosure of corporate financial data could potentially harm the firm's commercial reputation and operational processes. Given the double-extortion tactics of the Akira group, the publication of this data may be intended to exert pressure on the organization.

Ransomware attacks involving data exfiltration often utilize double-extortion tactics. In these scenarios, threat actors do not merely encrypt an organization's systems to disrupt operations; they also steal sensitive information. The attackers then threaten to publish this stolen data on public leak sites if the ransom is not paid. This method increases the pressure on the victim, as the threat of public disclosure can lead to significant reputational damage, legal liabilities, and regulatory scrutiny.

The types of data involved in this claim could trigger legal sanctions and compliance obligations under regional data protection regulations. When such breaches occur, organizations often face the necessity of initiating a forensic investigation to determine the actual scope of the leak and to identify all affected parties. Such investigations are critical for understanding how the perimeter was breached and what specific assets were compromised.

For organizations operating in the technology and telecommunications sectors, maintaining robust security postures is essential to mitigate these risks. Common defensive steps often include implementing multi-factor authentication, maintaining rigorous patch management schedules, and conducting regular employee training to recognize phishing attempts. Furthermore, continuous monitoring of network traffic and the implementation of zero-trust architectures can help in detecting and containing unauthorized access before large volumes of data can be exfiltrated.