Calida listed on Akira ransomware leak site

• Ransomware group: Akira
• Country: Australia
• Sector: Professional Services
• Announcement date: March 25, 2024

Akira claims data breach at Calida

The Akira ransomware group has officially listed the professional services firm Calida on its dedicated leak site. According to the announcement made on March 25, 2024, the threat actor group claims to have successfully breached the organization's network. The group has asserted that they have obtained a significant amount of data and has threatened to publish this information in the near future.

Ransomware leak sites serve as a platform for cybercriminal groups to exert pressure on their victims through a method known as double extortion. In this scenario, attackers do not merely encrypt an organization's files to disrupt operations; they also exfiltrate sensitive data. The threat of leaking this stolen information publicly is used as leverage to coerce the victim into paying a ransom. While the specific ransom demand for this incident has not been disclosed, the threat of data exposure remains a primary tool for the Akira group.

Details of the alleged data theft

The Akira group claims that the volume of data stolen from Calida's network is approximately 26 GB. The group has stated that various files allegedly obtained from the organization's network are contained within this data set. Although the group has made these claims, no screenshots of the stolen data have been provided to verify the contents of the leak.

The information allegedly targeted in this attack includes a variety of sensitive organizational records. The specific types of data claimed to be involved in the leak are:

• HR data
• Financial data
• Accounting data
• Project information

The exposure of such diverse datasets—ranging from human resources to financial records—highlights the broad scope of the alleged intrusion. When a breach involves multiple departments, the potential impact on the organization's internal operations and external obligations increases significantly.

About Calida

Calida is a high-end construction and project management company that was established in 2008. The organization specializes in the retail, hospitality, and commercial sectors, providing professional services tailored to these specific industries. Given its role in large-scale construction and project management, the company handles complex data related to various commercial and industrial projects.

Potential risks and organizational implications

The alleged leak of sensitive information poses several secondary risks to the organization, its employees, and its clients. For the individuals involved, the exposure of HR and financial data can lead to serious threats such as identity theft or targeted phishing attacks. These types of attacks often leverage the stolen personal information to gain further access to systems or to defraud individuals directly.

Furthermore, the disclosure of financial and accounting data may lead to significant legal and regulatory consequences. In the context of an Australian-based organization, such an incident could fall under the scrutiny of the Australian Privacy Act 1988. Beyond legal compliance, the use of double extortion by the Akira group can cause substantial reputational damage to the organization if the stolen data is indeed published.

There is also a potential for indirect risks to emerge regarding the organization's supply chain partners. Because professional services firms are often integrated into the workflows of their clients, a breach in one company can create vulnerabilities for others in the network. Additionally, given the Akira group's known focus on exploiting VPN accounts, it is possible that vulnerabilities existed within the organization's network security processes.

To defend against such threats, organizations in the professional services sector often implement various security measures. These include strengthening access controls, particularly for remote access solutions like VPNs, and implementing robust monitoring to detect unauthorized data exfiltration. Maintaining rigorous data governance and ensuring compliance with regional privacy laws are also critical components of a modern cybersecurity posture.