DBSA hit by Akira ransomware attack

• Ransomware group: Akira
• Country: South Africa
• Sector: Financial Services
• Announcement date: June 22, 2023

The Development Bank of Southern Africa (DBSA) has been listed on the leak site of the Akira ransomware group. According to the announcement made on June 22, 2023, the group claims to have conducted a ransomware attack against the organization on the same day.

Details of the claimed attack

The Akira group alleges that the ransomware attack against DBSA took place on June 22, 2023. In their announcement, the threat actors stated that they are prepared to assist the organization in the process of recovering its systems. To facilitate this, the group has requested that a representative from the organization contact them directly.

Furthermore, the threat actors claim that they are currently conducting an internal investigation. The stated purpose of this investigation is to ensure that the information belonging to DBSA is not leaked to the public. This type of behavior is common among ransomware groups that utilize double extortion tactics, where they threaten to release sensitive data if a ransom is not paid, often using the investigation period to pressure the victim.

Data and evidence status

Regarding the specifics of the breach, there is no information provided regarding the nature of the leaked or threatened data. The listing does not specify the types of files or information that have been targeted. Additionally, no screenshots were provided by the threat actor to substantiate their claims or to demonstrate the extent of the access obtained.

Affected data

• No data types were specified in the listing.

Organization profile

The Development Bank of Southern Africa (DBSA) is a development finance institution based in South Africa. The organization plays a critical role in the region by supporting economic development and regional integration through the financing of various infrastructure projects.

Risk assessment and industry implications

This incident suggests a potential disruption to the operational continuity of an organization operating within the financial services sector. If a data breach has indeed occurred, the exposure of customer financial information could significantly increase the risk of identity theft and fraud. Furthermore, the organization may face legal sanctions or complex compliance processes under relevant financial regulations and data protection laws.

The Akira group is recognized as a Ransomware-as-a-Service (RaaS) operator that emerged in early 2023. This group is known for employing double extortion tactics, which involve both encrypting systems and threatening to leak stolen data to maximize leverage over the victim. It is assessed that the group frequently gains network access through the exploitation of VPN accounts.

Secondary risks associated with such an attack include the potential use of leaked data in targeted phishing campaigns, where attackers use stolen information to craft convincing messages to deceive employees or customers. Organizations in the financial sector often focus on strengthening defenses against such threats by implementing multi-factor authentication, particularly for VPN access, and maintaining robust monitoring to detect unauthorized access early.