Ascoma Group targeted by Akira ransomware group

• Ransomware group: Akira
• Country: Monaco
• Sector: Financial Services
• Announcement date: March 13, 2025

Akira ransomware group claims data breach at Ascoma Group

The Akira ransomware group has listed 12 GB of data, allegedly belonging to Ascoma Group, on their dedicated leak site. The announcement, which appeared on March 13, 2025, suggests a significant breach involving sensitive corporate and personal information. This incident follows the pattern of modern ransomware operations where threat actors target high-value organizations to maximize leverage during extortion attempts.

Details of the alleged attack

According to the announcement made by the Akira group, the breach occurred on March 12, 2025. The threat actors claim to have successfully obtained various corporate documents belonging to Ascoma Group. Specifically, the group asserts that the stolen data is related to the organization's international operations and its health insurance management processes. The threat actor has indicated that the stolen data is currently ready for publication, a common tactic used to pressure victims into meeting ransom demands.

Ransomware leak sites serve as a platform for cybercriminals to host stolen data, often using it as a tool for double extortion. In a double extortion scheme, attackers do not merely encrypt an organization's systems to disrupt operations; they also exfiltrate sensitive data before the encryption phase. The threat of leaking this information publicly is then used to coerce the victim into paying a ransom. This method increases the pressure on the target, as the consequences of non-payment shift from operational downtime to reputational damage and legal liabilities.

Scope of the alleged data theft

While no screenshots were provided to verify the contents of the stolen files, the information provided by the Akira group suggests a wide-ranging exposure of sensitive information. The data allegedly includes a variety of personal and corporate details that could be highly sensitive for both the company and the individuals involved. The claimed data types include:

• Employee contact information
• Customer contact information
• Email addresses
• Internal correspondence
• Passports
• Personal documents

The inclusion of highly sensitive items, such as passports and personal documents, significantly elevates the severity of the incident. Such data is particularly valuable to malicious actors for identity theft and other fraudulent activities.

Organization profile: Ascoma Group

Ascoma Group is an insurance brokerage and risk management company specializing in international operations, health insurance, and healthcare cost management. With an extensive network across Africa and Europe, the firm provides comprehensive insurance solutions for individuals and corporations.

Implications and potential risks

This incident may result in the exposure of personal data belonging to Ascoma Group employees and customers. The publication of such information could potentially lead to identity theft and targeted phishing attacks against the affected individuals. When sensitive documents like passports are involved, the risk to the individuals' privacy and security is substantially increased, as these documents are often used to verify identities in fraudulent schemes.

Given the sector and the nature of the data, regulatory scrutiny under frameworks such as GDPR may be expected. Organizations in the financial and insurance services sectors handle vast amounts of sensitive personal and health-related information, making them primary targets for cybercriminals. The leaked documents may also potentially create risks for supply chain security, as the breach of a service provider can impact the entire network of partners and clients connected to that organization.

To defend against such threats, organizations typically implement a multi-layered security approach. This includes robust data encryption for data at rest and in transit, strict access controls to limit the exposure of sensitive information, and continuous monitoring of network traffic to detect unauthorized data exfiltration. Furthermore, regular security awareness training for employees is essential to mitigate the risk of initial access through phishing, which remains a common entry vector for ransomware groups like Akira.