Old National Events Plaza targeted by Akira ransomware group

• Ransomware group: Akira
• Country: United States
• Sector: Hospitality
• Announcement date: February 10, 2025

The Akira ransomware group has officially listed Old National Events Plaza on its dedicated leak site. According to the announcement made by the threat actors, the group claims to have successfully acquired sensitive corporate data belonging to the organization. This development follows the group's established pattern of targeting various sectors to exert pressure through data exposure.

The alleged attack and claims

The Akira group posted the listing for Old National Events Plaza on February 10, 2025. While the specific date of the initial intrusion remains unconfirmed by the victim, the group's announcement indicates that the alleged breach occurred around January 9, 2025. The threat actors claim to have obtained various corporate documents belonging to the organization, and the announcement explicitly signals an intent to publish the allegedly compromised data if their demands are not met.

Ransomware groups like Akira frequently utilize a tactic known as double extortion. In this model, attackers do not merely encrypt an organization's files to disrupt operations; they also exfiltrate sensitive information before the encryption process begins. By threatening to release this stolen data on public leak sites, the attackers create a secondary layer of pressure, targeting the victim's reputation and legal standing to increase the likelihood of a ransom payment.

Data types and information involved

The announcement provided by the Akira group specifies that the stolen information includes a variety of confidential materials. Although no screenshots were provided by the attackers to verify the contents of the stolen files, the group claims the following types of data were compromised:

• Financial data
• Employee contact information
• Customer contact information
• Contracts
• Licenses

The presence of such specific data types, including financial audits, payment details, and reports, suggests a significant breach of internal corporate documentation. The inclusion of contact numbers and email addresses for both employees and customers highlights the potential for further exploitation following the leak.

The organization profile

Old National Events Plaza is a multi-purpose event center located in Evansville, Indiana, USA. The facility serves as a venue for various events, conferences, and performances. Spanning 280,000 square feet, the facility provides comprehensive event planning and coordination services to its clients.

Implications and organizational risks

This alleged data leak poses several significant risks to the organization and its stakeholders. For the employees and customers whose contact information was reportedly stolen, the exposure of personal details may lead to secondary risks such as identity theft or highly targeted phishing attacks. When attackers possess specific details about an individual's relationship with a company, they can craft much more convincing social engineering campaigns.

Furthermore, the exposure of corporate financial data, licenses, and contracts could potentially damage the organization's commercial reputation and disrupt its operational processes. For a hospitality and event services provider, maintaining client trust and professional integrity is vital for continued business operations. Additionally, because the organization is based in the United States, this incident may trigger legal obligations under relevant state laws and various data protection regulations regarding breach notification and consumer privacy.

The Akira group, which has been active since early 2023, is known for operating as a Ransomware-as-a-Service (RaaS) model. They often gain initial access to networks through compromised VPN accounts, highlighting a critical vulnerability in remote access protocols. To mitigate such risks, organizations in the hospitality sector and beyond should consider robust defensive measures, such as implementing multi-factor authentication (MFA) on all remote access points, maintaining strict network segmentation, and conducting regular security audits to identify and patch vulnerabilities before they can be exploited by threat actors.