Akira ransomware group lists Braspress on leak site

• Ransomware group: Akira
• Country: Brazil
• Sector: Transportation
• Announcement date: July 31, 2024

Akira ransomware group claims data breach at Braspress

The transportation company Braspress has been listed on the leak site of the Akira ransomware group. According to the announcement made by the threat actors, the group claims to have exfiltrated over 70 GB of data from the organization's systems.

The incident was officially announced on the group's leak site on July 31, 2024. The Akira ransomware group alleges that they have successfully gained access to the company's internal systems and have obtained various corporate documents. By threatening to publish the allegedly stolen data, the group appears to be attempting to exert significant pressure on the organization to meet their demands.

Details of the alleged data theft

While the group has posted the organization on their leak site, they have not provided any screenshots to verify the contents of the stolen information. The announcement specifically mentions that the stolen data includes a variety of sensitive corporate and personal files. The types of data allegedly involved include:

• Contracts
• Agreements
• Employee personal data
• Financial documents

The presence of such sensitive information in the hands of a ransomware group highlights the escalating severity of modern cyberattacks, where the goal is not just system encryption but the exploitation of stolen information.

About Braspress

Braspress is a leading logistics and freight transportation company based in Brazil. The organization provides a wide range of services, including parcel delivery, e-commerce logistics, and corporate transportation services throughout the country.

Analysis and implications of the attack

This incident demonstrates the Akira group's use of double extortion tactics against its targets. Double extortion is a method where attackers not only encrypt an organization's data to disrupt operations but also steal sensitive information to threaten its public release. This creates a secondary layer of pressure, as the organization faces reputational damage and legal consequences if the data is leaked.

The allegedly leaked employee data and financial documents may pose secondary risks such as identity theft or fraud for the company's staff and stakeholders. Furthermore, under Brazil's LGPD (General Data Protection Law), the organization may face data breach notification obligations and potential administrative sanctions due to the nature of the compromised information.

From a technical perspective, the Akira group is known to exploit VPN vulnerabilities to gain network access. This suggests that organizations in the transportation and logistics sector may need to review similar access points to prevent unauthorized entry. The potential publication of this data could lead to negative impacts on the organization's commercial reputation, affecting its standing with clients and partners.

In general, when organizations face such threats, defensive strategies often involve strengthening remote access security, implementing strict multi-factor authentication, and ensuring robust monitoring of network traffic to detect unauthorized exfiltration. The risk of identity theft and fraud following such breaches underscores the importance of protecting personal and financial data through comprehensive security frameworks.