Moinho Globo Alimentos targeted by Akira ransomware group

• Ransomware group: Akira
• Country: Brazil
• Sector: Agriculture and Food Production
• Announcement date: January 14, 2025

Akira ransomware group claims data breach at Moinho Globo Alimentos

The Akira ransomware group has officially listed the Brazilian food production company Moinho Globo Alimentos on its dedicated leak site. According to the announcement made by the threat actors, the group claims to have successfully breached the organization's systems and exfiltrated a significant volume of corporate information. The group asserts that they have obtained 58 GB of data belonging to the company, and they have indicated that this information is currently prepared for public release.

The announcement regarding this incident was posted on the group's leak site on January 14, 2025. While the group claims to have gained access to the internal systems, the specific date of the initial intrusion is cited as December 5, 2024. This timeline suggests that the attackers may have maintained presence within the network for several weeks prior to the public announcement on their leak site.

Details of the claimed data exfiltration

While the Akira group has published a listing for Moinho Globo Alimentos, it is important to note that no screenshots were provided in the announcement to verify the contents of the stolen files. Despite the lack of visual evidence, the group has made specific claims regarding the categories of sensitive information contained within the 58 GB of data they say they have stolen.

According to the claims made by the ransomware group, the compromised data includes a variety of sensitive corporate and personal information. The specific types of data mentioned in the claim include:

• Employee contact information
• Customer contact information
• Email addresses
• Personal identification numbers (CNP/CPF/NIF)
• Internal financial documents

The inclusion of such diverse data types—ranging from individual identification numbers to internal financial records—highlights the potential breadth of the breach if the group's claims are accurate.

About Moinho Globo Alimentos

Moinho Globo Alimentos is a significant player in the food production industry within Brazil. The company operates primarily in the state of Paraná and specializes in the production of flour and various bakery products. As a major milling facility in the region, the organization plays a key role in the local food supply chain, serving as one of the largest milling operations in its area of operation.

Analysis of the threat and potential consequences

The situation involving Moinho Globo Alimentos highlights the evolving risks faced by the agriculture and food production sector. The Akira group is known to employ a double-extortion strategy. In such a scenario, attackers do not merely encrypt a company's systems to disrupt operations; they also steal sensitive data to use as leverage. By threatening to leak the stolen information on a public website, the group attempts to pressure the victim into paying a ransom to prevent the disclosure of trade secrets or personal information.

The potential consequences of such a breach are multifaceted. For the employees and customers of Moinho Globo Alimentos, the exposure of contact details and personal identification numbers (such as CNP, CPF, or NIF) creates a significant risk of identity theft and targeted phishing attacks. For the organization itself, the exposure of internal financial documents could lead to the loss of competitive advantage through the disclosure of trade secrets. Furthermore, under Brazil's data protection law, the LGPD, the organization may face administrative sanctions resulting from this data breach.

While public information regarding the Akira group's specific methods is limited, their historical activities suggest they may exploit vulnerabilities in VPNs to gain initial access to corporate networks. This incident may indicate underlying weaknesses in the organization's cybersecurity infrastructure. To defend against such threats, organizations in this sector often focus on strengthening perimeter security, implementing multi-factor authentication, and maintaining robust monitoring to detect unauthorized access attempts early in the attack lifecycle.