Akkanat Holding listed on Hunters ransomware leak site

• Ransomware group: Hunters
• Country: Türkiye
• Sector: Manufacturing
• Announcement date: August 20, 2024

Hunters ransomware group claims data breach at Akkanat Holding

The Hunters International ransomware group has listed Akkanat Holding on its dedicated leak site, claiming to have successfully compromised the organization's systems. According to the announcement made on August 20, 2024, the threat actor group alleges that they have exfiltrated a significant volume of data from the Turkish conglomerate.

This incident follows a common pattern in modern cyberattacks known as double extortion. In such scenarios, ransomware actors do not merely encrypt an organization's files to disrupt operations; they also focus on stealing sensitive information. By threatening to leak this data on a public forum, the attackers aim to increase the pressure on the victim to meet their demands. While the specific nature of the data has not been disclosed, the scale of the alleged theft is substantial.

Details of the alleged attack

The Hunters International group has made several specific claims regarding the breach. The group alleges that the attack occurred on August 20, 2024. According to their announcement, the threat actors conducted both encryption and data exfiltration activities within the organization's internal systems. This dual-pronged approach is designed to maximize the impact on the target, causing both immediate operational downtime and long-term reputational and legal risks.

The group's claims suggest a highly coordinated effort to penetrate the network and extract information before detection. By combining encryption—which prevents the company from accessing its own data—with exfiltration—which gives the attackers leverage through the threat of exposure—the group aims to create a high-stakes situation for the victimized entity.

Scope of the alleged data exfiltration

While the group has not provided specific details regarding the nature or categories of the exfiltrated data, they have provided metrics regarding the volume of the stolen information. The listing claims that the following data was taken:

• Total data size of 623.9 GB
• A total of 1,311,748 files

The absence of specific information regarding the contents of these files means the full impact on the organization's intellectual property or sensitive business information remains unknown at this time. However, the sheer number of files and the total gigabytes involved suggest a wide-reaching intrusion into the company's digital infrastructure.

About Akkanat Holding

Akkanat Holding is a prominent Turkish conglomerate based in Istanbul. The organization operates across several critical industrial sectors, including defense, aerospace, and automotive. The holding is recognized for its manufacturing and engineering solutions, as well as its significant technology-oriented investments and industrial production capacity.

Potential risks and implications

The claims made by the Hunters International group may pose significant risks to Akkanat Holding's operational continuity and data privacy. Depending on the actual content of the allegedly exfiltrated data, the organization could face secondary risks, such as identity theft or highly targeted phishing attacks directed at employees and business partners.

Because the organization operates in Turkey, a successful data breach of this magnitude may necessitate compliance with legal obligations under the Personal Data Protection Law (KVKK). Furthermore, the group is assessed to be derived from Hive code, which suggests that similar technical methods may have been employed during the attack. Such leaks can have a lasting negative impact on an organization's commercial reputation and trust within the industry.

In the manufacturing and engineering sectors, organizations often face high-stakes risks due to the sensitive nature of their technical specifications and industrial processes. To mitigate such risks, companies typically focus on robust defensive measures, including network segmentation, continuous monitoring, and strict access controls. Maintaining a strong security posture is essential for protecting both proprietary industrial data and the privacy of stakeholders.