Drywall Partitions listed on Akira ransomware leak site

• Ransomware group: Akira
• Country: United States
• Sector: Professional Services
• Announcement date: January 7, 2025

Drywall Partitions targeted by Akira ransomware group

The Akira ransomware group has officially listed the professional services firm Drywall Partitions on its dedicated leak site. According to the announcement made on January 7, 2025, the threat actors claim to have successfully breached the organization's network and intend to release sensitive information belonging to the company.

This development follows a pattern of double-extortion tactics frequently employed by ransomware groups. In such scenarios, attackers do not merely encrypt an organization's systems to demand a ransom for decryption; they also steal sensitive data to use as leverage. By threatening to publish private information on a public leak site, the attackers aim to pressure the victim into paying the ransom to prevent the exposure of confidential records.

The claimed attack and timeline

The threat actors behind the Akira group claim that they gained unauthorized access to the Drywall Partitions network on December 20, 2024. This suggests that the attackers may have maintained presence within the network for a period of time before the public announcement was made on the leak site.

The group asserts that they have obtained various private corporate documents through this breach. While the group has made these claims, no screenshots or specific evidence were provided in the initial announcement to verify the contents of the stolen data. No information was provided regarding the specific size of the data stolen or the total number of files compromised during the incident.

Alleged data types and sensitive information

The threat actor claims that the stolen data contains a variety of sensitive corporate and personal information. According to the group's announcement, the leaked data is said to include the following items:

• Financial documents
• Corporate correspondence
• Employee Social Security Numbers (SSN)
• Employee contact information

The exposure of such diverse data types presents significant risks. The inclusion of Social Security Numbers and contact details specifically points toward a high risk of identity theft and targeted phishing attacks directed at the employees of the organization. Furthermore, the loss of internal corporate correspondence and financial documents can impact a company's operational processes and commercial competitiveness.

Organizational profile

Drywall Partitions, Inc. is a construction firm specializing in commercial drywall installation and remodeling projects. The company focuses particularly on tenant finish build-outs and interior construction.

Risk assessment and defensive considerations

The alleged leak of this data may lead to significant consequences for the organization. The exposure of internal financial data can disrupt operational processes and impact the firm's competitive standing in the construction sector. Furthermore, the publication of such data may result in administrative and legal proceedings under relevant data protection regulations, as the exposure could violate privacy obligations.

While public information regarding the Akira group remains limited, they have demonstrated a tendency to exploit vulnerabilities in VPN (Virtual Private Network) systems to gain entry into networks. This specific method of attack suggests that organizations within the professional services and construction sectors may need to re-evaluate their network security postures, particularly regarding remote access protocols.

To mitigate the risks associated with such attacks, organizations generally focus on strengthening their defensive layers. This includes implementing robust multi-factor authentication, ensuring all VPN and remote access software is patched against known vulnerabilities, and maintaining strict monitoring of network traffic to detect unauthorized access early. Additionally, regular security awareness training can help employees identify the phishing attempts that often follow a data breach involving personal contact information.