Akran listed on Qilin ransomware leak site

• Ransomware group: Qilin
• Country: Italy
• Sector: Professional Services
• Announcement date: January 31, 2025

Qilin ransomware group claims attack on Akran

The professional services firm Akran has been listed on the leak site of the Qilin ransomware group. According to the announcement made by the threat actors, the organization was involved in a cyber incident occurring on December 19, 2024. The listing was officially posted on the group's leak site on January 31, 2025.

Ransomware leak sites serve as platforms where cybercriminal groups publish information about their victims to pressure them into paying ransoms. These sites often include names of targeted organizations and, in some cases, samples of stolen data. By publishing such announcements, ransomware groups aim to maximize the psychological and reputational pressure placed on the victim organization.

Details of the claimed incident

The Qilin ransomware group has published an announcement regarding the firm Akran. The post claims that the organization was targeted in a cyber incident that allegedly took place in mid-December 2024. Based on the nature of the announcement, the group appears to be employing a double-extortion strategy.

Double extortion is a common tactic used by modern ransomware operations. In this method, attackers do not merely encrypt an organization's files to disrupt operations; they also exfiltrate sensitive data before the encryption process begins. The attackers then threaten to leak this stolen information on public forums or leak sites if the ransom is not met. This approach allows criminals to demand payment even if the victim has robust backups that can restore their systems, as the threat of data exposure remains a potent lever for extortion.

Data involved in the incident

Regarding the specific details of the breach, the provided record contains no information regarding the nature of the leaked or threatened data. The listing does not specify the types of files, the volume of data, or the specific contents that have been compromised or are being held for ransom.

About Akran

Akran is an Italy-based firm providing legal and consulting services through an interdisciplinary team of attorneys, consultants, engineers, and accountants. The company offers international support in both judicial and extrajudicial processes.

Analysis and implications for professional services

Qilin is known as a Ransomware-as-a-Service (RaaS) group that has been active since 2022 and utilizes double-extortion tactics. Given the firm's operation in the professional services sector, sensitive client information and proprietary business data may be at risk. Because the firm is based in Italy, any data breach could potentially lead to regulatory consequences under the General Data Protection Regulation (GDPR).

Furthermore, the leaked data might be exploited for identity theft or targeted phishing campaigns. The group's history suggests that the publication of such data could potentially result in reputational damage for the organization. For professional service providers, maintaining client confidentiality is a cornerstone of their business model, making them high-value targets for extortion-based attacks.

Organizations operating in this sector can take several defensive steps to mitigate the risks associated with ransomware and data exfiltration. Implementing strict access controls and the principle of least privilege can help limit the movement of an attacker within a network. Regular security awareness training can assist employees in identifying phishing attempts, which are often the initial entry point for such attacks. Additionally, robust monitoring and detection capabilities are essential for identifying unauthorized data transfers, which is a critical component in preventing the successful execution of double-extortion tactics.