Koury Engineering listed on Akira ransomware leak site

• Ransomware group: Akira
• Country: United States
• Sector: Manufacturing
• Announcement date: August 4, 2023

The Akira ransomware group has officially listed Koury Engineering on its dedicated leak site. Through this announcement, the threat actor group claims to have successfully compromised the organization and obtained sensitive information belonging to the firm.

Details of the alleged attack

The listing was announced on August 4, 2023. According to the claims made by the Akira group, they have gained access to confidential contracts and various types of employee data belonging to the engineering firm. While the group has not provided any screenshots to substantiate their claims, they have indicated that a significant amount of data is involved in this incident.

The group has stated that over 80 GB of data will be uploaded to the internet in the future. At this time, no specific information regarding a ransom demand has been disclosed by the attackers, nor has a specific file count been provided in the announcement.

Data types involved in the claim

The Akira group claims that the breach involves several categories of sensitive information. Based on the group's announcement, the following data types have been compromised:

• Employee data
• Contracts
• Project information

The group specifically mentioned that the stolen information includes confidential contracts, agreements, non-disclosure agreements (NDAs), employee data, and various project details.

About Koury Engineering

Koury Engineering is an engineering firm based in the United States. The company provides a specialized range of services, including geotechnical engineering, material testing, and inspection services. Their operations support both residential and commercial construction projects throughout the Southern California region.

Analysis and implications of the incident

This incident may indicate that the Akira group is employing double-extortion tactics to pressure the organization. Double extortion is a common ransomware strategy where attackers not only encrypt an organization's data but also steal sensitive information, threatening to leak it publicly to increase the pressure to pay the ransom. The presence of employee data in the alleged leak could increase the risk of identity theft and targeted phishing attacks against the staff.

Given the firm's sector and operational region, the data breach may lead to legal consequences regarding local privacy regulations and contractual obligations. The exposure of trade secrets may result in a loss of competitive advantage and potential long-term operational damages for the firm.

Public information regarding the Akira group suggests that it typically gains network access by exploiting VPN vulnerabilities and targets both Windows and Linux environments. Organizations in similar sectors can defend themselves by implementing robust security measures, such as securing remote access points, enforcing multi-factor authentication, and maintaining regular backups of critical data.