Gallos Metal Solutions targeted by Akira ransomware group

• Ransomware group: Akira
• Country: United States
• Sector: Manufacturing
• Announcement date: June 27, 2024

Akira ransomware group claims data breach at Gallos Metal Solutions

The Akira ransomware group has officially listed Gallos Metal Solutions on its dedicated leak site. According to the announcement made on June 27, 2024, the threat actor group claims to have successfully breached the organization's networks. This intrusion allegedly allowed the group to exfiltrate various internal files from the company's systems. The group has indicated that the stolen data may be released to the public, a common tactic used during cyber extortion campaigns.

Details of the alleged intrusion

The claim of unauthorized access was announced by the Akira group on June 27, 2024, following an alleged attack date of June 26, 2024. The group asserts that they have gained access to the internal networks of Gallos Metal Solutions and have successfully moved various internal files out of the environment. While the group has made these claims on their leak site, no screenshots were provided to substantiate the presence of the stolen data at the time of the announcement. Furthermore, the group has not disclosed the total size of the data exfiltrated or the specific number of files involved in the breach. No specific ransom demand has been made public in the current listing.

Compromised data types

The announcement suggests that a variety of sensitive internal business and personal files have been compromised. The specific types of data claimed to be stolen include:

• Employee personal files
• Non-disclosure agreements (NDAs)
• Financial data
• Internal business files

The exposure of such diverse data types suggests a broad access level within the organization's digital infrastructure.

Impact and potential risks

The alleged leak poses several significant risks to the organization and its stakeholders. For the employees of Gallos Metal Solutions, the theft of personal files introduces a heightened risk of identity theft and various forms of fraud. For the company itself, the exposure of financial data could lead to significant disadvantages in commercial competition. Additionally, the compromise of internal business files and agreements could jeopardize the confidentiality of sensitive arrangements made with third parties.

Because the organization is based in the United States, the incident may trigger legal complexities. State-level data breach notification laws and potential legal sanctions may be applicable depending on the nature of the data and the specific jurisdiction. Furthermore, the Akira group is known for employing a double-extortion method. This technique involves both encrypting the victim's data and threatening to leak the stolen information publicly to increase pressure on the organization. Such a tactic can lead to severe reputational damage and create secondary risks for the organization's entire supply chain.

Defensive considerations for the manufacturing sector

While information regarding the Akira group remains limited, the incident highlights the ongoing risks faced by the manufacturing sector. Organizations in this sector often manage complex supply chains and sensitive intellectual property, making them attractive targets for ransomware groups. To mitigate such risks, organizations typically focus on strengthening network security, implementing robust access controls, and ensuring comprehensive monitoring of their digital environments. Protecting against double-extortion requires not only strong perimeter defenses but also rigorous data protection strategies to ensure that even if a breach occurs, the utility of stolen data is minimized.