Drivestream listed on Akira ransomware leak site

• Ransomware group: Akira
• Country: United States
• Sector: Technology
• Announcement date: January 7, 2025

Akira ransomware group claims breach of Drivestream

The Akira ransomware group has listed the technology consulting firm Drivestream on its dedicated leak site. According to the announcement, the threat actors claim to have successfully gained access to internal files and corporate documents belonging to the organization. The process of listing the company on the leak site was initiated on January 7, 2025.

Ransomware leak sites are platforms used by cybercriminal groups to pressure victims into paying ransoms. These sites often host lists of compromised organizations and, in many cases, samples of stolen data to demonstrate the severity of the breach. This specific incident involves a claim of data exfiltration rather than just encryption, a tactic often used to increase leverage over the victim.

Details of the alleged data theft

The Akira group asserts that they have obtained a significant volume of sensitive information. Specifically, the group claims to have stolen over 80 GB of private corporate documents. While the group has made these claims, no screenshots of the stolen data have been provided to verify the authenticity of the breach. No information was provided regarding the specific number of files or the amount of the ransom demand.

The alleged data includes highly sensitive personal information belonging to both employees and customers of the firm. The specific types of data mentioned in the claim include:

• Social Security Numbers (SSN)
• Family contact information
• Contact numbers
• Email addresses
• Driver licenses
• Passports

The presence of such sensitive identifiers, including government-issued IDs and social security numbers, highlights the potential severity of the alleged leak. When such data is exposed, it often leads to secondary risks for the individuals involved, such as identity theft or highly targeted phishing attacks.

About Drivestream

Drivestream is a management and IT consulting firm. The organization specializes in migrating the enterprise business processes of large and medium-sized businesses to the Cloud. As a firm operating within the technology sector, their services are integral to the digital infrastructure and operational workflows of their clients.

Analysis and potential impact

Akira is recognized as a double-extortion ransomware group. In a double-extortion scheme, attackers not only encrypt an organization's data to disrupt operations but also steal sensitive information to threaten the victim with public disclosure. This group is known to frequently exploit vulnerabilities in Virtual Private Networks (VPNs) to gain initial access to corporate networks.

Because Drivestream is based in the United States, the nature of the leaked data may trigger legal proceedings under federal regulations and state-level data privacy laws. The exposure of personal identifiers like passports and social security numbers typically necessitates strict regulatory reporting and can lead to significant legal and compliance challenges for the organization. Furthermore, such an incident can have negative impacts on the organization's operational continuity.

For organizations in the technology and consulting sector, maintaining robust security postures is critical. Common defensive steps to mitigate these risks include implementing multi-factor authentication (MFA) across all remote access points, such as VPNs, to prevent unauthorized entry. Additionally, organizations often focus on regular vulnerability management to patch known flaws and employ data loss prevention (DLP) tools to monitor and control the movement of sensitive information. Given that public information regarding the Akira group remains limited, organizations must remain vigilant against their evolving tactics.