Knight ransomware group lists Akir Metal San Tic Ltd ti was hacked. All confidential information was stolen on its leak site

• Ransomware group: Knight
• Country: Türkiye
• Sector: Manufacturing
• Announcement date: December 13, 2023

Knight ransomware group claims data theft at Akım Metal San Tic Ltd ti

The threat actor group known as Knight has claimed responsibility for a cyberattack against Akım Metal San. Tic. Ltd. Şti. According to an announcement made on a leak site on December 13, 2023, the group alleges that they have successfully infiltrated the company's network and exfiltrated various types of corporate information. The group claims that the breach occurred around December 8, 2023, though they have not provided specific details regarding the exact method used to gain access, aside from the allegation that vulnerabilities in the company's network were exploited to reach sensitive files.

Ransomware attacks involving data theft often follow a pattern known as double extortion. In these scenarios, attackers do not merely encrypt a company's systems to disrupt operations; they also steal sensitive information to use as leverage. By threatening to leak confidential documents on public leak sites, attackers aim to pressure the victim into paying a ransom to prevent the exposure of trade secrets, personal data, or proprietary information. While the Knight group has made these claims, information regarding the group's specific identity and operational history remains limited.

The scope of the alleged data breach

According to the claims made by the Knight group, the stolen information is highly sensitive and covers a wide range of corporate and personal categories. The threat actor alleges that the breach includes access to customer information and various confidential documents. Although the group has not provided any screenshots to verify the validity of their claims, they have listed several categories of data that were purportedly taken during the intrusion.

The specific types of data mentioned in the group's announcement include:

• NDA documents
• Personal data
• Insurance data
• Financial documents
• Engineering information
• Patents
• R&D documents
• Customer information
• Employee and management correspondence

The theft of such diverse datasets suggests a deep level of access within the corporate network. When attackers target engineering and research-related files, the impact often extends beyond immediate operational disruption to long-term strategic damage.

About Akım Metal San Tic Ltd ti

Akım Metal is a manufacturing company with a significant presence in the industrial sector. The company specializes in producing metal parts for several critical industries, including the automotive, home appliance, motor, aircraft, and defense sectors. Their production processes involve specialized methods such as machining and metal injection. With over 40 years of experience in the industry, the company has established itself as a long-standing player. Furthermore, since 2011, Akım Metal has been actively developing technological projects through its dedicated R&D center.

Potential implications and industry risks

If the claims made by the Knight group are verified, the incident could lead to several secondary risks for the organization and its stakeholders. For the company's customers and employees, the exposure of personal and insurance data could lead to risks such as identity theft or the execution of targeted phishing attacks. Furthermore, the potential leak of engineering information, patents, and R&D documents poses a significant threat to the company's competitive advantage and could jeopardize its trade secrets.

From a regulatory perspective, since the company is based in Türkiye, this incident may trigger mandatory notification obligations under the Personal Data Protection Law (KVKK). Additionally, because Akım Metal serves critical sectors like defense and aerospace, the breach represents a potential risk to the security of its business partners and the broader supply chain. In the manufacturing sector, maintaining robust cybersecurity measures is essential to protect intellectual property and ensure the continuity of supply chains.

Organizations in similar sectors can mitigate such risks by implementing strict access controls, conducting regular vulnerability assessments, and ensuring that sensitive R&D data is isolated from general corporate networks. Furthermore, maintaining a comprehensive incident response plan and ensuring compliance with local data protection regulations are vital steps in managing the fallout of a potential breach.