BEST VISION allegedly targeted by Akira ransomware group

• Ransomware group: Akira
• Country: Switzerland
• Sector: Professional Services
• Announcement date: May 20, 2025

Akira ransomware group claims data breach at BEST VISION

The professional services firm BEST VISION has allegedly been targeted by the Akira ransomware group. According to an announcement made on a ransomware leak site, the threat actors claim to have successfully exfiltrated a significant amount of corporate data belonging to the organization. This incident follows a pattern of double-extortion tactics frequently employed by modern ransomware groups, where stolen data is used as leverage to pressure victims into paying a ransom.

The announcement regarding this alleged breach was published on May 20, 2025. While the listing appears on a known leak site, it is important to note that these claims are made by the threat actor and have not been independently verified. Ransomware leak sites serve as a platform for these groups to publish stolen information to damage the reputation of their targets or to demand payment through public pressure.

Details of the alleged exfiltration

The Akira ransomware group claims to be in possession of over 24 GB of corporate documents. The threat actor asserts that the stolen data is highly sensitive and includes a variety of documents related to both the company's internal operations and its external relationships. According to the group's claims, the breach involves a wide range of personal and professional information.

The specific types of data allegedly included in the leak are:

• Employee personal documents
• Client personal documents
• Passports
• Driver licenses
• Confidentiality agreements
• Project data

Despite the claims made by the group regarding the volume and nature of the data, no screenshots were provided in the announcement to substantiate the contents of the alleged breach. No information was provided regarding a specific ransom demand or the exact method used to gain access to the network.

Impact and potential risks

This incident may pose significant risks of identity theft and targeted phishing attacks for both employees and clients of the organization. When sensitive personal identifiers such as passports and driver licenses are compromised, the risk of secondary crimes increases significantly. Furthermore, the inclusion of confidentiality agreements and project data suggests that the breach could impact the firm's commercial reputation and client trust.

Given the nature of the alleged data, the organization could face regulatory scrutiny under the Swiss Federal Act on Data Protection (FADP) and the General Data Protection Regulation (GDPR). It is possible that the breach originated from compromised VPN credentials or similar access points, which is a common vector for ransomware attacks. As a professional services entity, the organization may face increased scrutiny regarding supply chain security and data handling practices following such an event.

General defensive considerations

In the wake of such incidents, organizations in the professional services sector often focus on strengthening their security posture. Common defensive steps include implementing multi-factor authentication (MFA) to protect access points like VPNs, enhancing monitoring for unusual data exfiltration patterns, and conducting regular security awareness training to mitigate phishing risks. Strengthening supply chain security and ensuring rigorous data handling practices are also critical for maintaining client trust and meeting regulatory requirements.