Akira ransomware group lists Steiner (Austrian furniture makers) on its leak site

• Ransomware group: Akira
• Country: Austria
• Sector: Manufacturing
• Announcement date: March 6, 2024

Akira ransomware group claims data breach at Steiner

The Akira ransomware group has listed the Austrian furniture manufacturer Steiner on its dedicated leak site. According to the group's announcement, they claim to be in possession of approximately 20 GB of data belonging to the organization. This listing was officially posted on the group's platform on March 6, 2024, marking a new target for the threat actor.

Ransomware leak sites serve as a platform for cybercriminal groups to exert pressure on their victims. In these scenarios, the threat actors often use the threat of releasing stolen information to coerce organizations into paying a ransom. This tactic is a common feature of modern cyber extortion campaigns, where the goal is not just to encrypt systems but to compromise the confidentiality of sensitive corporate and personal information.

Details of the alleged data theft

The announcement made by the Akira group on March 6, 2024, alleges a significant data breach. The group claims that the stolen information is expected to be released for public download in the near future. While the group has provided a specific volume for the alleged theft, they have not provided any screenshots to verify the contents of the files.

The group claims that the stolen data includes a variety of sensitive corporate and personal documents. Based on the announcement, the following types of information are said to be involved:

• HR documents
• Contracts
• Client information
• Project files

The presence of such diverse data types suggests a broad compromise of the organization's internal file structures. When a group claims to have access to human resources and client files, it indicates that the breach may extend beyond operational files into the realm of personally identifiable information (PII).

About Steiner

Steiner is an Austrian furniture manufacturer. The company specializes in the production of individual furniture pieces, focusing on a combination of creativity, aesthetics, and functionality in their designs.

Analysis and potential implications

This incident may indicate that the Akira group is attempting to exert pressure on the organization using double-extortion tactics. Double extortion is a method where attackers not only encrypt an organization's data to disrupt operations but also steal sensitive information to threaten its public release. This dual approach increases the pressure on the victim, as the threat of a data leak can cause significant reputational and legal damage even if the organization can restore its systems from backups.

The alleged presence of personal data within the files could trigger legal processes under the General Data Protection Regulation (GDPR). Because the organization is based in Austria, it is subject to strict data protection laws regarding the handling and security of personal information. Furthermore, the breach poses secondary risks to the company's stakeholders. For the organization's employees and clients, the theft of personal information may lead to risks such as identity theft or targeted phishing attacks.

The group's known activities suggest a focus on exploiting vulnerabilities in Virtual Private Networks (VPNs). This pattern of behavior highlights the importance for organizations to maintain rigorous security protocols. To defend against such threats, organizations in the manufacturing sector and beyond often need to conduct regular reviews of their network security protocols. Strengthening authentication methods, implementing multi-factor authentication, and ensuring that remote access points like VPNs are patched and secured are critical defensive steps to mitigate the risk of unauthorized access by ransomware groups.