National AirVibrator listed on Akira ransomware leak site

• Ransomware group: Akira
• Country: United States
• Sector: Transportation
• Announcement date: February 25, 2025

Akira ransomware group claims data breach at National AirVibrator

The Akira ransomware group has listed the American company National AirVibrator on its dedicated leak site. According to the group's announcement, which was posted on February 25, 2025, the attackers claim to have obtained and published a significant amount of the company's internal corporate information. The group asserts that the breach occurred as early as December 6, 2024.

Ransomware groups often utilize leak sites to exert pressure on their victims through a tactic known as double extortion. In these scenarios, attackers do not merely encrypt a company's systems to disrupt operations; they also steal sensitive data and threaten to release it publicly if a ransom is not paid. This approach increases the leverage held by the cybercriminals, as the threat of public exposure can cause lasting damage to a company's reputation and legal standing.

Details of the alleged data leak

The Akira group has claimed that the stolen data consists of approximately 40 GB of information. To facilitate the distribution of this alleged data, the group has provided a torrent-based method for downloading the files. Notably, the group has stated that the archives provided via this method are password-free, allowing for easier access to the contents.

While no screenshots were provided by the group to verify the contents of the breach, the group claims that the leaked files include a variety of sensitive corporate and personal information. The specific types of data allegedly involved in the leak include:

• Non-disclosure agreements (NDAs)
• Financial documents
• Employee contact information
• Customer contact information
• Driver's licenses

The presence of such diverse data types, ranging from high-level corporate contracts to individual identification documents, highlights the potential impact of the breach on both the organization and the individuals whose data was targeted.

About National AirVibrator

National AirVibrator (NAVCO) is an American company that specializes in the manufacture of industrial vibrators and vibratory equipment. These products are specifically designed to facilitate the flow of bulk materials within storage hoppers, bins, and railcars. The company provides essential industrial solutions primarily for the rail transportation, foundry, and process manufacturing industries.

Security implications and organizational risks

The use of double-extortion tactics by the Akira group suggests that the leaked data may pose significant secondary risks to both the organization and the affected individuals. For the company, the exposure of sensitive documents could lead to long-term reputational damage. Furthermore, because the company is based in the United States, this incident may trigger specific legal obligations under various state-level data protection laws regarding breach notification and data security.

For the individuals whose data was allegedly stolen, the risks are equally severe. The exposure of employee and customer contact information, combined with sensitive documents like driver's licenses, could facilitate identity theft and the execution of highly targeted phishing campaigns. When attackers possess specific details such as NDAs or financial documents, they can craft much more convincing social engineering attacks against the organization or its partners.

In terms of technical vulnerability, the Akira group is known for its tendency to exploit vulnerabilities in Virtual Private Networks (VPNs) to gain initial access to corporate networks. This highlights the importance for organizations to maintain a comprehensive and rigorous review of their network security posture. To defend against such threats, organizations in the transportation and manufacturing sectors often implement multi-factor authentication, conduct regular vulnerability assessments, and enforce strict access controls to limit the potential movement of an attacker within the network.