Old National Events Plaza listed on Akira ransomware leak site

• Ransomware group: Akira
• Country: United States
• Sector: Hospitality
• Announcement date: February 25, 2025

Old National Events Plaza targeted by Akira ransomware group

The Akira ransomware group has officially listed Old National Events Plaza on its dedicated leak site. According to the announcement made on February 25, 2025, the threat actors claim to have successfully infiltrated the organization and obtained various types of sensitive data. This listing follows a claimed attack date of January 9, 2025, though the group's specific claims regarding the breach remain unverified.

The threat actor asserts that they have gained unauthorized access to a variety of corporate documents and sensitive information belonging to the institution. In terms of data distribution, the group appears to be utilizing torrent-based methods for the allegedly stolen information, a common tactic used by ransomware groups to facilitate the dissemination of large datasets across peer-to-peer networks.

Details of the alleged data theft

While no screenshots were provided by the attackers to substantiate their claims, the announcement specifies a wide range of sensitive information that has allegedly been compromised. The group claims to have access to a variety of internal documents and personal identifiers that could pose significant risks if released publicly.

The data types mentioned in the leak include:

• Corporate agreements and licenses
• Financial reports and audit data
• Payment details
• Employee contact information
• Customer contact information

It is important to note that the group has not provided specific details regarding the total volume of data stolen or the exact number of files involved in the incident. Furthermore, no specific ransom demand has been publicly disclosed in the announcement.

About Old National Events Plaza

Old National Events Plaza is a large-scale event center located in Indiana, USA. The facility serves as a venue for a wide variety of events, including conferences and meetings. Spanning 280,000 square feet, the venue is designed to provide flexible space and planning services to support the needs of various professional organizations.

Analysis and potential implications

The targeting of a hospitality and event services provider by the Akira group highlights the ongoing risks faced by organizations that manage significant amounts of client and employee data. Given the Akira group's known use of double-extortion tactics, the potential public release of this alleged data could lead to substantial reputational damage for the institution. Double extortion is a strategy where attackers not only encrypt an organization's systems but also threaten to leak sensitive data to pressure the victim into paying a ransom.

The exposure of the specific data types mentioned—such as financial records and personal contact details—could trigger secondary risks for the affected parties. These risks include identity theft or the launch of targeted phishing campaigns aimed at employees and customers. Because the organization is based in the United States, such an incident may necessitate compliance with various federal regulations and state-level data breach notification laws, which govern how and when an organization must inform individuals about the compromise of their personal information.

The group's historical focus on exploiting vulnerabilities in Virtual Private Networks (VPNs) suggests that the organization's network security posture may require a comprehensive review to mitigate similar risks in the future. For organizations in the hospitality sector, maintaining robust security protocols is essential to protect the privacy of clients and the integrity of financial transactions. General defensive measures often include implementing multi-factor authentication, maintaining rigorous patch management schedules, and conducting regular security audits to identify and remediate vulnerabilities before they can be exploited by threat actors.