Akira ransomware group lists Merkanti Bank Ltd on leak site

• Ransomware group: Akira
• Country: Malta
• Sector: Financial Services
• Announcement date: February 25, 2025

Akira ransomware group claims data breach at Merkanti Bank Ltd

The Akira ransomware group has officially listed Merkanti Bank Ltd on its leak site, claiming to have accessed sensitive corporate information. This announcement, made on February 25, 2025, suggests a significant security incident involving the financial institution. While the claim remains an allegation by the threat actor, the listing marks a potential escalation in the group's targeting of the financial services sector.

The Akira group is known for employing double extortion tactics. In such scenarios, attackers do not merely encrypt an organization's systems to disrupt operations; they also exfiltrate sensitive data with the intent to threaten its public release. This dual-layered approach is designed to maximize pressure on the victim, using the threat of reputational damage and regulatory scrutiny to coerce the organization into paying a ransom. Publicly available information regarding the specific inner workings of the Akira group remains limited, but reports indicate they frequently gain initial access to networks by exploiting vulnerabilities in VPN accounts.

The details of the alleged attack

According to the announcement published by the group, the breach involves the acquisition of essential corporate documents. The threat actors claim to possess a variety of internal files that could be highly damaging if released. While the group has made these claims, it is important to note that no screenshots or specific evidence were provided in the initial leak site post to verify the contents of the stolen data.

The information allegedly stolen by the Akira group includes several categories of sensitive data:

• Financial data
• Payment details
• Internal databases

The group has threatened to release these materials if their demands are not met. The nature of these files suggests a deep penetration into the organization's internal systems, targeting the core information required for daily banking operations and regulatory compliance.

About Merkanti Bank Ltd

Merkanti Bank Ltd is a credit institution that operates under the supervision and licensing of the Malta Financial Services Authority. The organization is deeply integrated into the financial ecosystem of Malta, focusing its primary business activities on merchant banking, factoring, and a variety of general corporate banking services. Given its role as a licensed credit institution, the bank maintains a high level of responsibility regarding the protection of the financial data it manages for its corporate clients.

Potential impact and industry implications

The alleged exposure of this data carries significant risks for both the institution and its stakeholders. For the customers and employees of Merkanti Bank Ltd, the theft of financial and payment details creates a heightened risk of identity theft and various forms of fraud. Such incidents can lead to long-term security challenges for individuals whose private information is circulating in illicit forums.

For the institution itself, the consequences are multifaceted. Operating within the financial services sector, the bank is subject to strict regulatory frameworks. The exposure of sensitive data could potentially lead to significant regulatory sanctions under the General Data Protection Regulation (GDPR) in the European Union. Beyond legal and regulatory repercussions, the bank faces substantial reputational damage and the potential for significant disruption to its operational processes. Furthermore, leaked information can be utilized by threat actors to launch secondary attacks, such as highly targeted phishing campaigns designed to exploit the specific details found in the stolen databases.

In the broader context of cybersecurity, this incident highlights the ongoing necessity for organizations to harden their perimeter defenses. To mitigate the risks associated with the tactics used by groups like Akira, organizations typically focus on securing remote access points, such as implementing multi-factor authentication for all VPN accounts and conducting regular audits of access logs. Strengthening data encryption and implementing robust monitoring to detect unauthorized exfiltration are also critical defensive measures for any entity operating in the financial sector.