New Balance Commodities listed on Akira ransomware leak site

• Ransomware group: Akira
• Country: United States
• Sector: Agriculture and Food Production
• Announcement date: June 14, 2024

Akira ransomware group claims breach of New Balance Commodities

The Akira ransomware group has listed New Balance Commodities on its dedicated leak site, claiming a significant data breach. According to the announcement made on June 14, 2024, the threat actors claim to have exfiltrated approximately 24 GB of data from the organization. This announcement marks a potential data leak incident involving the United States-based entity.

Ransomware leak sites are platforms used by cybercriminal groups to pressure victims into paying ransoms. These groups often employ a tactic known as double extortion, where they not only encrypt an organization's internal systems but also steal sensitive data. By threatening to publish this stolen information publicly, the attackers aim to maximize their leverage during negotiations. The presence of an organization on such a site indicates that the attackers claim to have successfully bypassed security measures and extracted valuable assets from the target's network.

Details of the claimed attack and exfiltration

The Akira ransomware group announced its targeting of New Balance Commodities via a post on its leak site. The group claims to have obtained various documents that are directly related to the institution's core business operations, specifically regarding grain processing and feed production. The group has stated that the 24 GB of data they claim to have stolen will be made available for public access in the near future.

While the group has made these claims, it is important to note that no screenshots of the stolen data have been provided to support the announcement. Furthermore, no specific ransom demand has been disclosed in the current listing. The incident is characterized as a data leak, focusing on the unauthorized exfiltration of information rather than just the encryption of local files.

Alleged sensitive information involved

The data allegedly stolen by the Akira group is said to include a variety of sensitive documents. Based on the claims made by the threat actors, the following types of information are involved:

• Financial data
• Bank details
• Vendor information
• Contracts
• Operational reports

The exposure of such diverse datasets suggests that the attackers may have gained access to multiple internal directories and administrative systems within the organization's infrastructure.

Potential impact and security implications

This incident may result in the exposure of the institution's critical financial and operational data. The leaked information could potentially lead to identity theft or targeted phishing attacks against employees and business partners. Because the stolen data includes vendor information and contracts, the security of the organization's supply chain could be negatively impacted. Furthermore, the publication of this data may create negative impacts on the institution's commercial reputation.

The Akira group is known to operate as a Ransomware-as-a-Service (RaaS) entity. This business model allows specialized developers to lease their ransomware code to affiliates, who then carry out the actual attacks. It has been reported that the Akira group frequently exploits VPN accounts to gain their initial access to a network. Once inside, they move laterally to identify and exfiltrate high-value data.

As the institution operates in the United States, the breach may lead to legal proceedings under state-level data protection laws and sectoral regulations. Organizations in the agriculture and food production sector should remain vigilant against such threats. To mitigate the risks of similar attacks, it is common practice for organizations to implement robust multi-factor authentication (MFA) on all remote access points, such as VPNs, to prevent unauthorized entry. Additionally, maintaining strict network segmentation and implementing comprehensive monitoring of data egress can help detect and prevent large-scale exfiltration attempts. Regular security audits and employee training regarding phishing awareness are also essential components of a modern defensive posture.