Caputo listed on Akira ransomware leak site

• Ransomware group: Akira
• Country: Italy
• Sector: Financial Services
• Announcement date: April 14, 2025

Akira claims data breach at Caputo

The Akira ransomware group has announced a data leak involving the financial services firm Caputo. According to the announcement made on the group's leak site on April 14, 2025, the group claims to have successfully conducted a ransomware incident against the organization.

The Akira group claims to possess 20 GB of data allegedly obtained from the firm's networks. While information regarding this specific group remains limited, it is known to operate as a Ransomware-as-a-Service (RaaS) entity. Such entities typically employ double extortion tactics, a method where attackers not only encrypt an organization's data to disrupt operations but also steal sensitive information to threaten its public release if a ransom is not paid.

In a double extortion scheme, the threat of leaking sensitive data serves as a powerful lever to exert pressure on the victim. This tactic shifts the focus from mere operational disruption to the potential for massive reputational damage and legal liability, significantly increasing the pressure on the targeted organization to comply with ransom demands.

Alleged data contents and scope

According to the announcement, the leaked data allegedly includes a wide variety of sensitive documents and personal information. No screenshot has been provided by the group to verify the contents of the stolen files. The information allegedly obtained from the network includes the following:

• Non-disclosure agreements
• Personal social security numbers
• Internal corporate correspondence
• Employee and customer contact details
• Driver licenses
• Corporate licenses
• Agreements
• Financial audit reports

The breadth of the alleged data suggests a significant breach of both corporate and personal information, spanning from administrative legal documents to highly sensitive identification numbers and financial records.

About Caputo

Caputo & Co. is a financial consulting firm based in Italy. The company provides a range of professional services to small businesses, including accounting, tax preparation, and strategic business planning. Additionally, the firm offers part-time CFO services and assists clients with bank loan proposals and general financial management.

Risk assessment and implications

This incident may increase the risk of identity theft for Caputo's employees and customers due to the sensitive nature of the alleged data. Given the sensitivity of the information claimed to be stolen, the firm may face legal consequences under the European Union's General Data Protection Regulation (GDPR).

Furthermore, the leaked financial data and contracts could pose secondary risks to the firm's supply chain partners. When financial audits and corporate agreements are compromised, the security and privacy of associated business partners can be jeopardized, potentially leading to a ripple effect of risk across the professional network.

The use of double extortion by the Akira group is likely intended to exert maximum pressure on the firm through the threat of data publication. In response to such incidents, organizations often find it necessary to warn their stakeholders against potential targeted phishing attacks that may follow a data leak. Furthermore, it is common for firms in the financial sector to undergo a thorough review of their security protocols to mitigate future risks and strengthen their defensive posture against evolving ransomware threats.