Great Plains Bank listed on Akira ransomware leak site

• Ransomware group: akira
• Country: United States
• Sector: Financial Services
• Announcement date: December 16, 2024

The Akira ransomware group has officially listed Great Plains Bank on its leak site. In an announcement made on December 16, 2024, the threat actor group claimed to have compromised a significant amount of corporate data belonging to the financial institution, threatening to release the information if their demands are not met.

The claimed attack and event details

According to the announcement published by the Akira group, the attackers claim to have successfully exfiltrated 18 GB of data from the organization. The group alleges that the compromised information includes sensitive internal corporate documents as well as personal information. This announcement, which was posted on December 16, 2024, serves as a threat to the institution, with the group stating their intent to publish the stolen data.

Ransomware groups often utilize a tactic known as double extortion. In this method, attackers do not just encrypt an organization's systems to disrupt operations; they also steal sensitive data before the encryption occurs. The threat of leaking this stolen data on a public leak site serves as additional leverage to pressure the victim into paying a ransom. While the specific details of the attack method were not provided in the listing, the group's involvement suggests a targeted operation aimed at extracting high-value information.

The scope of the alleged data theft

While no screenshots were provided to verify the contents of the stolen data, the Akira group has specified the types of information they claim to have in their possession. The alleged breach involves a variety of sensitive documents and personal identifiers that could impact both the institution and its stakeholders. The data types mentioned in the claim include:

• Driver licenses
• Employee contact information
• Customer contact information
• Non-disclosure agreements

The presence of such diverse data types, ranging from legal agreements to government-issued identification, highlights the potential breadth of the intrusion. When such information is leaked, it often results in a loss of privacy for the individuals involved and can lead to various secondary risks.

About Great Plains Bank

Great Plains Bank is a full-service community bank with established branches located in Oklahoma and Texas. The institution provides a wide array of financial services to its clients, including personal banking, various types of loans, savings accounts, and mortgage services.

Potential risks and industry implications

The situation involving Great Plains Bank presents several significant risks. For the employees and customers whose information has allegedly been stolen, the leak of driver's licenses and contact details can lead to secondary threats such as identity theft and highly targeted phishing attacks. These types of attacks often use stolen personal information to gain trust and manipulate victims into revealing even more sensitive credentials or transferring funds.

For a financial services institution, a data breach of this nature carries heavy consequences. Beyond the immediate operational disruption, the organization may face significant compliance issues with regulatory bodies. Furthermore, the leaked data could lead to potential legal sanctions under various US state laws. The reputational damage caused by the publication of such data can be long-lasting, as trust is a fundamental component of the banking sector.

From a technical perspective, the Akira group is known for exploiting vulnerabilities in Virtual Private Networks (VPNs) to gain initial access to networks. This highlights the critical importance of robust network security processes and regular reviews of remote access protocols. Additionally, a breach of this scale can pose risks to supply chain security, as the compromised data might be used to target the institution's partners or vendors. Organizations in the financial sector typically prioritize multi-factor authentication, rigorous patch management, and continuous monitoring to defend against such sophisticated threats.