Menway targeted by Akira ransomware group in alleged data leak

• Ransomware group: Akira
• Country: France
• Sector: Professional Services
• Announcement date: January 30, 2025

Akira ransomware group claims data breach at Menway

The Akira ransomware group has published a claim on its leak site regarding a data breach involving Menway, a professional services firm based in France. According to the announcement, which was posted on January 30, 2025, the threat actors have allegedly accessed a significant volume of corporate information. The group claims the attack took place around January 10, 2025, and they have indicated that the stolen data is prepared for public release.

Ransomware groups often utilize leak sites to exert pressure on their victims. This process is frequently part of a double extortion strategy, where attackers not only encrypt an organization's systems but also threaten to publish sensitive information on public forums if a ransom is not paid. By hosting these claims on dedicated websites, threat actors aim to maximize visibility and damage the reputation of the targeted entity.

Details of the alleged data theft

The Akira group claims to have exfiltrated over 20 GB of data belonging to Menway. While the threat actor has stated that the data is ready for publication, no screenshots or specific file counts were provided to verify the contents of the leak. The announcement suggests that the stolen information is highly sensitive and covers various aspects of the company's internal and external operations.

The specific types of data mentioned in the claim include:

• Employee contact information
• Customer contact information
• Financial data
• HR documents
• Non-disclosure agreements

The presence of such diverse data types—ranging from human resources documentation to financial audits and payment details—suggests a comprehensive breach of the organization's digital environment. The inclusion of non-disclosure agreements and contact details for both staff and clients highlights the potential breadth of the exposure.

About Menway

Menway is a French company that operates within the professional services sector. The organization provides a variety of human resources solutions designed for both businesses and individual employees. Their service portfolio includes expertise in recruitment, temporary staffing, and career management, making them a key player in the human resources landscape in France.

Potential impact and security implications

The alleged exposure of this data carries significant risks for Menway and its stakeholders. For employees and customers, the leak of contact information and sensitive documents increases the risk of identity theft and targeted phishing campaigns. Such attacks often use stolen personal details to craft highly convincing messages, tricking individuals into revealing even more sensitive information or transferring funds.

Furthermore, the potential release of financial audits, payment details, and HR documents could negatively impact Menway's business operations. Because the company operates within the European Union, such a breach may trigger administrative processes and legal considerations under the General Data Protection Regulation (GDPR) regarding data protection violations. The risk extends to the supply chain, as the compromise of a service provider can create vulnerabilities for the various businesses that rely on their human resources solutions.

From a technical standpoint, the Akira group has shown a tendency to exploit vulnerabilities in Virtual Private Networks (VPNs) to gain initial access to networks. This pattern suggests that organizations in this sector should prioritize a rigorous review of their network security processes, particularly regarding remote access points. Strengthening authentication methods, implementing continuous monitoring, and ensuring that all edge devices are patched against known vulnerabilities are standard defensive steps that organizations can take to mitigate the risk of similar intrusions.