Helbor targeted by Akira ransomware group in alleged data breach

• Ransomware group: Akira
• Country: Brazil
• Announcement date: March 26, 2025

Akira ransomware group claims data theft from Helbor

The Akira ransomware group has claimed responsibility for a cyberattack targeting Helbor, a prominent real estate development company based in Brazil. According to an announcement made on the group's leak site on March 26, 2025, the attackers claim to have gained unauthorized access to the organization's network and successfully exfiltrated a significant volume of data.

The group asserts that they are in possession of various corporate documents and sensitive information belonging to the company. This claim follows a pattern of behavior often seen in modern ransomware operations, where threat actors move beyond simple encryption to focus on the theft of proprietary information to increase their leverage during negotiations.

Details of the alleged data exfiltration

The Akira group has listed approximately 54 GB of data that they claim belongs to Helbor. While the group has made these assertions on their leak site, no screenshots were provided to verify the contents of the stolen files. The announcement, dated March 26, 2025, suggests that the breach occurred on the same day the claim was posted.

The data allegedly stolen during this incident includes a wide variety of sensitive corporate and personal information. The specific types of data mentioned in the claim include:

• Corporate NDAs
• Internal correspondence
• Financial data
• Corporate licenses
• Agreements and contracts
• Employee contact information
• Customer contact information

The nature of this data suggests a broad compromise of the company's internal operations and client-facing information.

About Helbor

Helbor is a prominent real estate development company based in Brazil. The organization is particularly recognized for its residential and commercial projects located within the metropolitan region of São Paulo.

Impact and security implications

This alleged data breach carries significant risks for both the organization and the individuals whose information may have been compromised. The exposure of sensitive data can lead to several secondary threats. For employees and customers, the theft of contact information and other personal details increases the risk of identity theft or the execution of highly targeted phishing attacks. Such attacks often leverage stolen context to appear legitimate to the victim.

From a business perspective, the exposure of financial audits, payment reports, and legal contracts could negatively impact Helbor's business operations. Furthermore, such an incident may trigger legal proceedings under Brazil's LGPD data protection regulations, as the company is required to protect the personal data of its constituents. The publication of this information also poses risks to supply chain security and can cause lasting damage to the organization's reputation.

The Akira group is known for utilizing double-extortion tactics, a method where attackers not only encrypt a victim's systems but also threaten to leak sensitive data to pressure the organization into paying a ransom. This tactic significantly increases the pressure on an organization, as the threat of public exposure remains even if systems are restored from backups.

The group has also demonstrated a known tendency to exploit vulnerabilities in VPNs to gain initial access to networks. This highlights the importance for organizations to maintain rigorous network security protocols and conduct regular reviews of their remote access infrastructure. To defend against such threats, organizations typically focus on strengthening identity and access management, implementing multi-factor authentication, and maintaining robust monitoring of network traffic to detect unauthorized access attempts early in the attack lifecycle.