Divimast listed on Akira ransomware leak site

• Ransomware group: Akira
• Country: Italy
• Sector: Professional Services
• Announcement date: January 17, 2025

Akira ransomware group claims Divimast data breach

The Akira ransomware group has officially listed the Italian professional services company Divimast on its leak site. According to the announcement made on January 17, 2025, the threat actors claim to have successfully compromised the organization's network and exfiltrated sensitive information. The group alleges that the initial intrusion occurred around December 20, 2024, and they are currently holding the data for ransom.

The threat actors claim to be in possession of approximately 8 GB of private corporate documents. While the group has not specified a ransom demand, they have indicated that the stolen files may be published on their leak site if their demands are not met. This follows a common pattern in modern cyberattacks where the threat actor uses the threat of public disclosure to pressure the victim into paying a ransom.

Details of the claimed data exfiltration

The leak announcement provides specific details regarding the types of information the Akira group claims to have stolen from Divimast. Although no screenshots were provided by the group to verify the contents of the stolen files, the listing describes a significant amount of sensitive corporate and personal information. The compromised data is said to include various categories of confidential documentation that could impact both the company and its stakeholders.

The specific types of data mentioned in the claim include:

• Confidential agreements
• Internal financial documents
• Employee passports
• Identity cards
• HR documents
• Contact details for employees and customers

The presence of such highly sensitive documents, particularly identity documents and financial records, suggests a significant breach of privacy that could have long-term implications for the affected individuals and the organization itself.

About Divimast

Divimast is a business consulting company based in Italy. The firm is characterized by a team of consultants who possess over 20 years of experience in the industry. The company focuses on providing customized solutions tailored to the specific needs of their diverse client base, leveraging their extensive professional expertise to assist businesses in various capacities.

Risks and implications of the incident

This incident poses a substantial risk of identity theft for the employees and customers of Divimast, given the claimed theft of passports, identity cards, and contact information. Furthermore, because the company operates within Italy, it may face administrative sanctions under GDPR regulations regarding the protection of personal data. Such regulatory frameworks are designed to ensure that organizations maintain strict controls over the personal information they process.

The Akira group appears to be employing a double extortion method. In this scenario, the attackers do not just encrypt the victim's systems but also steal sensitive data to use as leverage. This method introduces secondary risks, such as the potential sale of the stolen data to third parties or its public disclosure on the dark web. Such actions can lead to severe reputational damage and legal liabilities for the organization.

Additionally, the breach may create opportunities for targeted phishing attacks against the company's supply chain partners, as the stolen contact details and internal documents can be used to craft highly convincing fraudulent communications. Given the known tendency of the Akira group to exploit VPN accounts, organizations in this sector may need to re-evaluate their network security protocols and strengthen their perimeter defenses to prevent similar unauthorized access in the future.

General defensive considerations

In response to such threats, organizations often focus on implementing multi-factor authentication, especially for remote access points like VPNs, to mitigate the risk of credential exploitation. Regular security audits, enhanced monitoring of network traffic, and comprehensive employee training on phishing awareness are also standard defensive measures used to protect against the tactics employed by ransomware groups.