Custom Engineering & Fabrication, Inc. targeted by Akira ransomware group

• Ransomware group: Akira
• Sector: Manufacturing
• Announcement date: November 22, 2023

The Akira ransomware group has listed Custom Engineering & Fabrication, Inc. on its leak site, claiming to have exfiltrated data from the organization. This announcement, made on November 22, 2023, marks a potential significant data breach for the manufacturing entity.

The details of the claim

According to the notice published by the Akira group on November 22, 2023, the threat actors claim to have successfully targeted Custom Engineering & Fabrication, Inc. The group asserts that they have obtained approximately 700 GB of data from the organization. The announcement specifically states that the organization has not shown interest in recovering the stolen data. Consequently, the group has declared its intention to release the stolen files publicly in the near future.

Ransomware groups often use leak sites to pressure victims into paying ransoms. This tactic is part of a broader trend in cybercrime where attackers do not just encrypt systems but also steal sensitive information. When a victim refuses to negotiate or pay, the attackers threaten to publish the data to maximize the pressure on the organization's reputation and legal standing.

Data involved in the alleged breach

The announcement provided by the Akira group mentions that the archives containing the stolen information consist of various business documents and personal information. While the group has made these claims, no screenshots were provided to verify the contents of the data. The listing identifies the following types of affected data:

• Personal data
• Business documents

The presence of personal data alongside business documents suggests a broad scope of the alleged exfiltration, potentially impacting both internal operations and individual privacy.

The mechanics of double extortion

The situation described follows the pattern of double-extortion tactics commonly employed by modern ransomware groups. In a double-extortion scenario, attackers first exfiltrate sensitive data and then deploy ransomware to encrypt the victim's systems. This ensures that even if the organization has robust backups to restore their systems, they still face the threat of their sensitive information being leaked publicly, which can lead to significant reputational and regulatory consequences.

Implications and organizational risks

The alleged leak poses several significant risks to the organization. The exposure of personal data belonging to employees or customers could lead to legal sanctions and administrative fines under relevant data protection regulations. Furthermore, the publication of such data can create a foundation for targeted phishing attacks against the organization's supply chain partners, as attackers may use the stolen business documents to craft highly convincing fraudulent communications.

Given the nature of the Akira group's tactics, there is a high probability that the leaked information could be utilized in secondary fraudulent activities. The group's methods suggest a focus on maximizing the impact of the breach through multiple avenues of pressure.

Defensive considerations for the manufacturing sector

Organizations operating in the manufacturing sector often face unique challenges due to their complex supply chains and the integration of various digital systems. To mitigate the risks associated with such breaches, organizations typically focus on several defensive layers. This includes implementing strict access controls to limit the amount of data available to any single user, maintaining comprehensive logging to detect unauthorized data movement, and conducting regular audits of data protection measures.

Furthermore, because leaked data can be used to target supply chain partners, manufacturers must prioritize secure communication channels and rigorous identity verification processes to defend against sophisticated phishing and social engineering attempts. While information regarding the Akira group remains limited, the potential for secondary exploitation highlights the necessity of a holistic approach to data security and incident response.