AMI Consulting Engineers listed on Akira ransomware leak site
AMI Consulting Engineers has been listed on the Akira ransomware group's leak site, with claims that internal corporate documents have been compromised.
- Published
- 2 min read
- 2 min read
- Ransomware group: Akira
- Country: United Kingdom
- Sector: Professional Services
- Announcement date: November 29, 2024
AMI Consulting Engineers listed on Akira ransomware leak site
AMI Consulting Engineers has been listed on the Akira ransomware group's leak site, with claims that internal corporate documents have been compromised. The threat actor claims to have obtained a significant volume of data belonging to the organization, marking a potential data breach incident.
The alleged attack and Akira group claims
The Akira ransomware group listed data allegedly belonging to AMI Consulting Engineers on their leak site on November 29, 2024. According to the group's announcement, the attack occurred around November 26, 2024. The threat actor claims to have obtained over 30 GB of internal corporate documents during the operation.
The group appears to be employing a double extortion tactic. In such scenarios, ransomware actors do not merely encrypt an organization's systems to disrupt operations; they also exfiltrate sensitive data to use as leverage. By threatening the publication or sale of the exfiltrated data on a public leak site, the attackers attempt to pressure the victim into paying a ransom to prevent the exposure of confidential information.
Details of the compromised data
According to the announcement, the compromised data includes various sensitive documents. While no screenshot has been provided to verify the contents, the group claims the following types of information were taken:
- Non-disclosure agreements (NDAs)
- Human resources information
- Confidential agreements
- Social security numbers (SSNs)
- Personal medical documents
The presence of such diverse data types suggests a broad access to both corporate and personal information within the organization's network.
About AMI Consulting Engineers
AMI Consulting Engineers is an engineering and consulting firm specializing in infrastructure projects such as ports, coastal structures, dams, buildings, and industrial facilities. The company provides innovative solutions in the fields of hydraulic structures and coastal engineering.
Risk assessment and organizational implications
This incident may pose secondary risks such as identity theft and targeted phishing attacks for the organization's employees and partners. Given that the organization is based in the UK, the breach may result in legal consequences regarding data protection obligations under the UK GDPR. The double extortion tactic used by the Akira group could lead to reputational damage for the organization if the data is made public.
Based on the group's known activities, it is assessed that such attacks are often facilitated by the exploitation of VPN vulnerabilities. When attackers exploit vulnerabilities in Virtual Private Networks, they can often gain a foothold in the network, allowing them to move laterally and locate sensitive data repositories.
For organizations facing similar threats, common defensive steps include implementing multi-factor authentication, maintaining rigorous patch management for all remote access gateways, and conducting regular backups that are stored offline or in immutable environments. Furthermore, organizations may need to initiate data breach notification procedures and inform the affected parties to mitigate the impact of potential identity theft or phishing campaigns.