Get Away Today listed on Akira ransomware leak site

• Ransomware group: Akira
• Country: United States
• Sector: Hospitality
• Announcement date: January 29, 2024

The Akira ransomware group has officially listed the travel booking platform Get Away Today on its dedicated leak site. According to the announcement made on January 29, 2024, the threat actor group claims to have successfully compromised the organization's systems and obtained sensitive data belonging to the company.

The claims made by Akira

The Akira ransomware group asserts that they have successfully accessed databases containing sensitive information. Specifically, the group claims to have obtained databases that contain personal information belonging to clients. This announcement is categorized as a data breach notification on the group's leak site.

While the group has claimed to have accessed these databases, the full scope and specific details of the leaked information remain unclear at this time. As of the current reporting, no screenshots have been provided by the attackers to verify the contents of the stolen data. Furthermore, the group has stated that the relevant data will be made available for public release in the near future.

In the context of modern cyber threats, this type of announcement is a hallmark of the double-extortion tactic. In a double-extortion scenario, ransomware actors do not merely encrypt an organization's files to disrupt operations; they also exfiltrate sensitive data. The attackers then use the threat of releasing this stolen information on a public leak site to pressure the victim into paying a ransom. This method significantly increases the pressure on an organization, as the threat of a public leak can lead to long-term consequences even if the systems are restored from backups.

Data involved in the alleged breach

The information provided by the threat actor group suggests that the breach involves sensitive information belonging to the company's users. Based on the claims made by the Akira group, the following data types are said to be affected:

• Client personal data

Because no specific file counts or specific data sizes were provided in the announcement, the exact volume of the compromised information remains unknown. The lack of visual evidence, such as screenshots of the stolen databases, means that the total extent of the data exposure cannot be verified through the leak site alone.

About Get Away Today

Get Away Today is a United States-based travel agency that specializes in providing discounted vacation packages and various ticket booking services. The company focuses heavily on family-oriented vacation planning, particularly for major destinations such as Disneyland and other popular vacation spots. Given its role in the hospitality sector, the organization handles significant amounts of client information related to travel arrangements and personal identities.

Analysis and implications for the hospitality sector

This incident carries significant risks for the individuals whose data has allegedly been compromised. The exposure of personal information can lead to severe consequences for victims, including the heightened risk of identity theft and various forms of financial fraud. For an organization based in the United States, such a breach may trigger specific legal obligations, including data breach notification requirements mandated by relevant state laws and federal regulations.

For the organization itself, the use of double-extortion by the Akira group poses a threat to corporate reputation. If the stolen data is published, the company may face secondary attack risks and long-term damage to its brand trust. Furthermore, because Get Away Today operates within the hospitality and travel sector, there is an increased likelihood that any leaked data could be weaponized in highly targeted phishing campaigns aimed at their customer base.

From a technical perspective, the Akira group has demonstrated a tendency to exploit vulnerabilities in Virtual Private Networks (VPNs) to gain initial access to networks. This suggests that the organization may have had weaknesses in its network security processes or perimeter defenses. To defend against such threats, organizations in the hospitality sector typically focus on strengthening authentication methods, implementing strict access controls, and maintaining rigorous patch management schedules to close vulnerabilities in remote access tools.