Empereon Constar allegedly targeted by Akira ransomware group

• Ransomware group: Akira
• Country: United States
• Sector: Professional Services
• Announcement date: July 25, 2024

Akira ransomware group claims data breach at Empereon Constar

The Akira ransomware group has allegedly targeted Empereon Constar, a professional services firm based in the United States. According to an announcement made on a ransomware leak site on July 25, 2024, the threat actor group claims to have successfully exfiltrated a significant volume of data belonging to the organization. The group's claim suggests a targeted operation aimed at compromising the company's internal information systems.

The incident was announced on July 25, 2024, coinciding with the date the group claims the attack took place. While the group has listed the data on their leak site, it is important to note that no screenshots were provided alongside the announcement. Consequently, the specific content and authenticity of the alleged data cannot be visually verified at this time.

Details of the alleged data theft

The Akira group claims to have obtained approximately 800 GB of data from the victim's network. The group alleges that the stolen information is highly sensitive and pertains directly to the company's operational processes. This type of claim is characteristic of modern ransomware operations, where the goal is to demonstrate the value of the stolen information to the victim.

According to the group's announcement, the stolen data includes several categories of sensitive information. The specific types of data mentioned in the listing are:

• Client data
• Employee files
• Financial data
• SQL database records

The presence of SQL databases and detailed financial records suggests that the breach may have access to core business operations and sensitive internal documentation. However, as previously noted, the lack of visual evidence means the actual contents of these files remain unverified.

About Empereon Constar

Empereon Constar is a business process outsourcing (BPO) company operating within the professional services sector. The organization provides end-to-end solutions for both front and back office operations. Their service portfolio includes various professional services for their clients, specifically focusing on areas such as customer service, sales, and operational support.

Potential impact and security implications

The alleged leak of such a large volume of data poses significant secondary risks. For the company's clients and employees, the exposure of personal and financial information could lead to identity theft and the execution of targeted phishing attacks. Because Empereon Constar operates as a business process outsourcing provider, the exposure of their data could potentially impact the security of their clients' supply chains.

The use of a leak site to announce the theft is a hallmark of the double-extortion method. In this tactic, ransomware groups not only encrypt a victim's systems but also steal sensitive data, threatening to publish it online to exert maximum pressure on the organization to pay the ransom. This method shifts the leverage from simple system availability to the permanent loss of data confidentiality.

Given the company's location in the United States, this incident may trigger investigations under various state-level data protection laws and oversight by regulatory bodies. Furthermore, the Akira group has a known tendency to exploit vulnerabilities in Virtual Private Networks (VPNs) to gain initial access to networks. This suggests that organizations in the professional services sector should prioritize a comprehensive review of their network security protocols, particularly regarding remote access points, to mitigate the risk of similar intrusions.

General defensive considerations

To defend against such threats, organizations often implement multi-layered security strategies. This includes robust patch management to close vulnerabilities, the implementation of multi-factor authentication (MFA) for all remote access services, and continuous monitoring of network traffic to detect unauthorized data exfiltration. Additionally, maintaining offline, immutable backups and conducting regular incident response drills are standard industry practices to minimize the impact of ransomware and data breach events.