Cryopak listed on Akira ransomware leak site

• Ransomware group: Akira
• Country: United States
• Sector: Manufacturing
• Announcement date: January 23, 2024

The Akira ransomware group has officially listed the United States-based organization Cryopak on its dedicated leak site. According to the announcement made on January 23, 2024, the threat actor group claims to have gained unauthorized access to the company's systems and is currently preparing archives containing the organization's data for imminent publication.

The details of the alleged attack

The Akira ransomware group has identified Cryopak as their latest target. In their public announcement, the group states that they are in the process of compiling archives that contain the organization's data, with the intention of publishing these files shortly. As of the time of the announcement, the group has not provided any screenshots to substantiate their claims, which means the actual extent and volume of the alleged leak cannot be independently verified through the provided information.

The Akira group is recognized in the cybersecurity landscape as a Ransomware-as-a-Service (RaaS) entity that first emerged in early 2023. This type of operational model involves developers creating the ransomware code and leasing it to affiliates who carry out the actual attacks. This group is known for employing double extortion tactics. In a double extortion scheme, attackers do not merely encrypt an organization's files to disrupt operations; they also exfiltrate sensitive data beforehand. The attackers then threaten to leak this stolen information on public forums or leak sites if the ransom is not paid, thereby exerting additional pressure on the victim through the threat of reputational damage and regulatory scrutiny.

Claimed data types and contents

While the group has not provided visual evidence of the stolen files, the announcement claims that the breached data includes a variety of sensitive documents. The information allegedly stolen is described as containing highly personal and corporate-sensitive files, including:

• Passport information
• Driver license information
• Non-disclosure agreements
• Corporate confidential agreements

Because no screenshots were provided by the threat actors, it remains impossible to confirm the authenticity or the specific contents of the files mentioned in the claim.

About Cryopak

Cryopak is a provider of cold chain packaging solutions. The company serves several critical industries, including the pharmaceutical, life sciences, biotech, and food sectors. It operates as a subsidiary of Integreon Global.

Risk assessment and implications

The nature of the documents claimed to be leaked by the Akira group suggests the inclusion of sensitive data that could potentially compromise the organization's operational confidentiality. If the claims are accurate, this alleged leak may significantly increase the risk of identity theft for the organization's employees and business partners, given the mention of passports and driver's licenses.

As a United States-based entity, the organization may face data breach notification obligations under relevant state laws and federal regulations depending on the specific nature of the data involved. Furthermore, the Akira group's use of double extortion methods could trigger secondary risks, such as targeted phishing attacks against the company or its partners, should the data be published online.

The group's known tendency to exploit VPN accounts for initial access highlights a common vulnerability in modern network environments. This type of threat necessitates a rigorous review of an organization's network security processes. To defend against such threats, organizations often implement multi-factor authentication, monitor for unusual VPN login patterns, and maintain robust data encryption and segmentation to limit the impact of an intrusion. For companies in the manufacturing and life sciences supply chain, maintaining the integrity and confidentiality of corporate agreements and personal identification data is vital to operational security and regulatory compliance.