Fiskars Group listed on Akira ransomware leak site

• Ransomware group: Akira
• Country: Finland
• Sector: Professional Services
• Announcement date: May 14, 2024

The Akira ransomware group has claimed responsibility for a significant data breach targeting the Fiskars Group. On May 14, 2024, the threat actor group listed the organization on its dedicated leak site, alleging that they successfully compromised the company's internal systems and exfiltrated a substantial volume of information.

The claimed attack event

According to the announcement made by the Akira group, the breach occurred on May 14, 2024. The group alleges that they have gained unauthorized access to the organization's servers and have successfully copied a massive amount of data. The threat actors claim that the total volume of the stolen information amounts to 2 TB.

In their public statement, the group asserts that the stolen files consist of sensitive documents. Furthermore, the announcement indicates that the group may provide access to these specific files in the future. This type of announcement is a common tactic used by ransomware groups to pressure victims into meeting their demands through public exposure.

Details of the claimed data

While the scale of the exfiltration is described as being 2 TB in size, the group has not provided specific details regarding the exact nature or the specific types of data contained within the stolen files. No screenshots or samples of the data were provided by the group to verify their claims. The listing names no specific data types.

Implications of the breach

This incident presents a significant risk of exposure for the Fiskars Group's corporate data and employee information. The Akira group is known for employing double-extortion tactics, a method where attackers not only encrypt an organization's data but also steal it to use as leverage. In such scenarios, the publication of sensitive information can lead to severe reputational damage and significant operational disruptions for the targeted organization.

Because the Fiskars Group is based in Finland, this breach may result in serious data protection violations and legal sanctions under the General Data Protection Regulation (GDPR). The potential leakage of sensitive information can also be utilized by malicious actors for identity theft or to facilitate highly targeted phishing campaigns against the organization or its stakeholders.

Security considerations and defensive posture

The Akira group has demonstrated a known tendency to exploit vulnerabilities in Virtual Private Networks (VPNs) to gain initial access to corporate networks. This pattern of behavior suggests that organizations facing similar threats may need to conduct a comprehensive review of their network security processes and perimeter defenses.

To mitigate the risks associated with ransomware and data exfiltration, organizations in the professional services sector and beyond can implement several defensive strategies. Strengthening identity and access management, particularly through multi-factor authentication, is a critical step in preventing unauthorized access via VPNs. Additionally, continuous monitoring of network traffic can help detect unusual data movements that might indicate exfiltration in progress. Regular security audits and vulnerability assessments are also essential to identify and patch weaknesses before they can be exploited by threat actors.