Cosmed listed on Akira ransomware leak site

• Ransomware group: Akira
• Country: Italy
• Sector: Healthcare
• Announcement date: February 17, 2025

The Italian-based company Cosmed has been listed on the leak site associated with the Akira ransomware group. According to the announcement made by the threat actors, the organization has been targeted in a cyberattack, resulting in an alleged data breach that could impact various stakeholders.

The claimed attack and event details

The Akira group claims to have obtained a significant volume of corporate documents belonging to Cosmed. Specifically, the group asserts that they have acquired over 25 GB of data. This information was officially added to the group's leak site on February 17, 2025. While the listing was posted in mid-February, the group claims the actual attack occurred on February 14, 2025.

Ransomware groups often use leak sites to apply pressure on their victims through extortion. This process typically involves a double-extortion tactic, where the attackers not only encrypt the victim's systems to disrupt operations but also steal sensitive data to threaten its public release. By threatening to publish internal documents, the attackers aim to coerce the organization into paying a ransom to prevent the exposure of confidential information.

In this specific instance, the Akira group has stated that various internal files will be published as part of their ongoing extortion campaign. No screenshot of the stolen data was provided in the leak site announcement to verify the contents of the breach.

The nature of the claimed data

Although no visual evidence was provided, the group has identified several types of sensitive information that they claim to have exfiltrated from Cosmed's systems. The data mentioned in the claim includes a variety of highly sensitive documents that could be used for malicious purposes if released.

The claimed data includes the following items:

• Passport scans
• Non-disclosure agreements (NDAs)
• Financial data
• Foreign identity cards

The exposure of such diverse datasets, ranging from identity documents to financial audit reports and payment details, presents a significant risk. When identity documents like passports and foreign identity cards are compromised, it often leads to increased risks of identity theft and fraudulent activities targeting the individuals involved.

About Cosmed

Cosmed is an Italian-based private company that operates within the healthcare and medical technology sector. The organization specializes in the manufacturing of diagnostic equipment used in various medical fields, including cardiopulmonary, metabolic, and body composition diagnostics. Furthermore, Cosmed provides specialized solutions tailored to the needs of medical device industries and the field of sports science.

Potential impact and industry implications

This alleged breach may pose a substantial risk of identity theft for the institution's employees and clients, given the sensitive nature of the identity documents mentioned. Furthermore, the exposure of financial data could potentially impact the institution's commercial reputation and disrupt its operational processes. Because the organization is based in Italy, any confirmed data breach may lead to significant legal consequences under the General Data Protection Regulation (GDPR) frameworks.

The use of double-extortion tactics by groups like Akira is a growing trend in the ransomware landscape. By leaking data, attackers can facilitate highly targeted phishing attacks, using the stolen information to craft convincing messages that trick employees or clients into revealing even more credentials or funds. This makes the breach not just a data theft issue, but a long-term security risk for the organization's ecosystem.

For organizations operating in the healthcare and medical device sectors, maintaining robust security postures is critical. This includes implementing strict access controls, conducting regular security audits, and ensuring comprehensive encryption for sensitive data both at rest and in transit. Additionally, organizations must be prepared for the regulatory complexities involving data privacy laws to mitigate potential legal and reputational damage following a security incident.