New Hampshire PublicRadio listed on Akira ransomware leak site

• Ransomware group: Akira
• Country: United States
• Sector: Government & Defense
• Announcement date: May 31, 2024

Akira ransomware group claims data breach at New Hampshire PublicRadio

The Akira ransomware group has officially listed New Hampshire PublicRadio on its dedicated leak site. According to the announcement made on May 31, 2024, the threat actor group claims to have successfully infiltrated the organization's network and exfiltrated a significant volume of data. This development marks a new instance of the Akira group targeting organizations to exert pressure through data exposure.

The group's announcement, which occurred on the same day as the claimed attack, asserts that they have obtained approximately 35 GB of data from the organization's internal systems. While the group has threatened to release this information publicly, no specific ransom demand has been made public at this time. The incident highlights the ongoing threat posed by ransomware groups that utilize leak sites to broadcast their successful breaches to the public.

Details of the alleged data exfiltration

The Akira group's claims regarding the stolen information suggest a focus on sensitive administrative and financial documentation. While the group has not provided any screenshots to verify the contents of the stolen files, the announcement specifies that the data reportedly includes several types of critical information. The breach, if verified, could impact the organization's internal operations and its relationships with various stakeholders.

The information the group claims to possess includes:

• Financial data
• Accounting records
• Grant information

The nature of these files suggests that the attackers are targeting the core administrative functions of the organization. In many ransomware scenarios, attackers prioritize such data because it contains sensitive information that can be used for further exploitation or to maximize the pressure on the victim during negotiations.

The Akira ransomware group and its tactics

Information regarding the Akira ransomware group remains relatively limited in the public domain. However, the group is known for employing double extortion tactics. This method involves not only encrypting an organization's data to disrupt operations but also stealing sensitive information to use as leverage. By threatening to leak the stolen data on a public site, the attackers aim to create significant reputational and legal pressure on the victim to pay a ransom.

Reports indicate that the group frequently exploits VPN accounts to gain their initial access to a target network. Once inside, they move through the environment to identify and exfiltrate high-value data. This method of entry underscores the critical importance of securing remote access points and implementing robust authentication measures to prevent unauthorized entry into corporate networks.

Implications and risks for the organization

The alleged leak presents several significant risks for New Hampshire PublicRadio. The exposure of financial and operational data can lead to various secondary consequences. For instance, the theft of sensitive information could facilitate identity theft or enable highly targeted phishing attacks directed at the organization's employees and stakeholders. Such attacks often use the stolen context to appear more legitimate and convincing.

Furthermore, the potential for public release of this data could result in substantial reputational damage. For a public-facing organization, the loss of trust from the community and stakeholders is a critical concern. Additionally, because the organization is located in the United States, this incident may trigger legal processes under various state laws and federal data protection regulations designed to protect sensitive information and govern how breaches are reported and managed.

In general, organizations facing such threats often look toward defensive strategies such as implementing multi-factor authentication, conducting regular security audits, and ensuring that all remote access points, such as VPNs, are strictly monitored and secured. The use of double extortion by groups like Akira demonstrates why protecting data integrity and confidentiality is just as vital as maintaining system availability.