Mermet allegedly targeted by Akira ransomware group

• Ransomware group: Akira
• Country: United States
• Sector: Manufacturing
• Announcement date: March 27, 2024

The manufacturing firm Mermet has reportedly been targeted by the Akira ransomware group. On March 27, 2024, the Akira group listed the organization on its dedicated leak site, claiming that a significant data breach has occurred. According to the claims made by the threat actors, the group has obtained approximately 30 GB of data belonging to the company.

The details of the alleged attack

The incident was announced by the Akira group on March 27, 2024, the same day they claim the attack took place. While public information regarding the specific methods used by the Akira group remains limited, the group is known for employing double extortion tactics. This strategy typically involves both encrypting an organization's systems and threatening to leak sensitive data to pressure the victim into paying a ransom. Furthermore, the group has been noted for frequently exploiting vulnerabilities in VPN accounts to gain initial access to networks.

In this specific instance, the group has posted a listing on their leak site, though no screenshots of the stolen data have been provided to support the claim. The announcement indicates that the breach involves various types of internal company information and sensitive records.

Affected data types

Based on the claims made by the Akira group, the following types of information are allegedly included in the leaked data:

• Employee HR records
• Personal information

About Mermet

Mermet is a manufacturing company that produces high-quality technical fabrics designed for solar control and energy efficiency. Based in Cowpens, South Carolina, the firm specializes in providing textile solutions, primarily focusing on interior shading systems.

Risk assessment and implications

The alleged leak poses significant risks to the organization and its stakeholders. For the employees of Mermet, the exposure of personal information and HR records could lead to serious consequences, such as identity theft or various attempts at fraud. Because the organization is based in the United States, such a data breach could trigger legal consequences under various state privacy laws and federal regulations.

The use of double extortion tactics by the Akira group presents a direct threat to the organization's operational continuity. By holding data hostage, attackers create a foundation for secondary attacks and long-term instability. Additionally, the sensitivity of the data involved may create indirect risks for the organization's various supply chain partners, who may be impacted by the breach of information.

Given the historical activities of the Akira group, there is a high possibility that the leaked data could be utilized in targeted phishing campaigns against the organization or its associates. In the manufacturing sector, such attacks can be particularly disruptive to business operations and trust. To mitigate such risks, organizations in this sector often focus on strengthening their perimeter defenses, particularly regarding VPN security, and implementing robust monitoring to detect unauthorized access before data can be exfiltrated.