Lydall, Inc. targeted by Akira ransomware group

• Ransomware group: Akira
• Country: United States
• Sector: Manufacturing
• Announcement date: November 29, 2023

Akira ransomware group claims data breach at Lydall, Inc.

The Akira ransomware group has listed data allegedly belonging to Lydall, Inc. on their leak site. On November 29, 2023, the threat actor group published a notice claiming to have targeted the organization. According to the announcement, the group has obtained various sensitive files and intends to share this information via their dedicated leak site.

Details of the alleged attack

The incident involves a claim made by the Akira group regarding a successful breach of Lydall, Inc. The group alleges that they have gained access to a variety of internal documentation. While the group has made these claims publicly on their platform, no screenshots have been provided to verify the contents of the alleged breach. The group's announcement suggests that the stolen information includes critical business and administrative assets.

Alleged compromised data types

The group claims to have compromised several categories of sensitive information. The specific data types mentioned in the claim include:

• Project files
• Technical drawings
• HR records
• Financial data
• Accounting documents

No information was provided regarding the total size of the data or the specific file count involved in this incident.

About Lydall, Inc.

Lydall, Inc. is a global manufacturing company that produces specialty engineered products for the thermal/acoustical and filtration/separation markets. The organization is headquartered in Manchester, Connecticut.

Risk assessment and industry implications

This incident may pose significant risks to the organization's operational continuity and intellectual property rights. The exposure of sensitive technical drawings and project files suggests a potential threat to the company's proprietary information. Furthermore, the compromise of HR and financial data could lead to secondary risks such as identity theft or fraud for both the employees and the organization itself.

Given the Akira group's known use of the double extortion method, the publication of stolen data can have a profound impact on an organization's commercial reputation. In such scenarios, ransomware actors typically steal sensitive data before encrypting systems, using the threat of leaking the information to pressure victims into paying a ransom. This method ensures that even if a company can restore systems from backups, they still face the risk of public exposure.

Furthermore, depending on the nature of the leaked data, legal processes under GDPR or other relevant data protection regulations may be triggered. The exposure of personal and financial information often necessitates formal reporting and legal scrutiny to ensure compliance with privacy standards.

The group's tendency to exploit VPN vulnerabilities suggests that the organization's network security processes may need to be reviewed. For organizations in the manufacturing sector, maintaining robust perimeter defenses and securing remote access points is a critical component of a modern security posture. Defensive strategies often include implementing multi-factor authentication, continuous monitoring of network traffic, and ensuring that all remote access tools are patched against known vulnerabilities to mitigate the risk of unauthorized entry.