Excel Security Corp. targeted by Akira ransomware group

• Ransomware group: Akira
• Country: United States
• Sector: Professional Services
• Announcement date: May 30, 2024

Akira ransomware group claims breach of Excel Security Corp.

The Akira ransomware group has officially listed Excel Security Corp. on its leak site, claiming to have successfully exfiltrated a significant amount of data from the organization. According to the announcement made on May 30, 2024, the group alleges that they have obtained approximately 150 GB of data belonging to the company. This claim follows a purported attack that occurred on the same day the announcement was posted.

The group's listing suggests a targeted operation aimed at the professional services firm. While the specific methods used to gain unauthorized access were not detailed in the announcement, the group alleges that the organization's existing security measures were bypassed. This type of claim is common in ransomware operations, where threat actors attempt to demonstrate the effectiveness of their intrusion to pressure the victim.

Details of the alleged data exfiltration

The Akira group has indicated that the stolen datasets will be made accessible in the near future. Although no screenshots were provided to verify the contents of the stolen files, the group has provided a list of the types of sensitive information they claim to have obtained. This information appears to span multiple categories, ranging from personal identifiers to sensitive corporate documentation.

The alleged data includes the following items:

• Employee personal files
• Social Security Numbers (SSN)
• Driver's licenses
• Phone numbers
• Emails
• Financial data
• Customer information
• Non-disclosure agreements

The inclusion of such diverse datasets suggests a comprehensive breach of the company's digital environment, covering both internal employee information and external client-related data.

Implications and potential risks

If the claims made by the Akira group are confirmed, the breach poses significant risks to both the organization and the individuals whose data has been compromised. For employees and customers, the exposure of Social Security Numbers, driver's licenses, and financial data significantly increases the risk of identity theft. Such sensitive information is highly valued by malicious actors for fraudulent activities.

Furthermore, the nature of the data stolen carries broader implications for the organization's business operations. Because Excel Security Corp. operates within the professional services sector, the leak of non-disclosure agreements (NDAs) and customer information could potentially lead to supply chain attacks. In these scenarios, attackers use the stolen information to impersonate the company or its clients to gain further access to other organizations within the supply chain.

The Akira group appears to be utilizing a double extortion method. In this tactic, attackers not only encrypt a victim's systems but also steal sensitive data, threatening to publish it on a leak site to coerce the victim into paying a ransom. This method often leads to secondary phishing attacks, where the stolen emails and phone numbers are used to target the victims with highly convincing fraudulent communications.

As a United States-based entity, the company may find itself subject to various data breach notification requirements dictated by relevant state laws and federal regulations. Organizations operating in this sector should prioritize robust data protection strategies, such as implementing multi-factor authentication, maintaining strict access controls, and ensuring comprehensive encryption for data at rest and in transit, to mitigate the impact of such potential incidents.