Pacific Summit Energy targeted by Akira ransomware group

• Ransomware group: Akira
• Country: United States
• Sector: Energy & Utilities
• Announcement date: May 16, 2025

The Akira ransomware group has posted an announcement on its leak site claiming responsibility for a cyberattack against Pacific Summit Energy. According to the threat actor, the breach resulted in the exfiltration of 163 GB of corporate data belonging to the United States-based energy company.

The alleged cyberattack and claim

The Akira group claims to have compromised data from Pacific Summit Energy following a cyberattack that allegedly occurred on April 22, 2025. The threat actor has made a specific mention of the entity's affiliation with Sumitomo Corporation and has stated that numerous internal files will be published as a result of the incident. The announcement regarding this data leak was officially listed on the group's leak site on May 16, 2025. No screenshot was provided by the group to verify the contents of the stolen data.

Details of the claimed data breach

The information allegedly stolen during the incident is extensive and covers various sensitive categories. The Akira group claims that the following types of data were compromised:

• Employee passport information
• Driver license information
• Credit card details
• Financial data
• Client data
• Non-disclosure agreements

In addition to these categories, the group claims the theft includes Sumitomo Corporation internal files, financial audits, invoices, and project information.

About Pacific Summit Energy

Pacific Summit Energy is an energy company that provides trading and logistics services for several key commodities, including natural gas, power, crude oil, and LNG. As an affiliate of Sumitomo Corporation, the company operates within global energy markets by combining local expertise with global resources.

Analysis and potential implications

The nature of this claim suggests that the Akira group may be attempting to exert pressure using double extortion tactics. Double extortion is a common ransomware strategy where threat actors not only encrypt an organization's data to disrupt operations but also steal sensitive information to threaten its public release. This method is designed to increase the pressure on victims to pay the ransom, as the threat of a data leak can cause significant reputational and regulatory damage.

The alleged exposure of personal information, such as passports and driver's licenses, could increase the risk of identity theft and targeted phishing attacks against both employees and clients. Furthermore, given that the entity's operations are based in the United States, the breach may trigger data breach notification obligations under relevant state laws and federal regulations. The corporate affiliation with Sumitomo Corporation may also suggest that the leak could pose secondary risks to supply chain security.

From a technical perspective, considering the group's known tendency to exploit VPN vulnerabilities, weaknesses in the organization's network security processes may be observed. To defend against such threats, organizations in the energy and utilities sector can implement various defensive measures. These include strengthening access controls, particularly for remote access solutions like VPNs, and maintaining robust monitoring of network traffic to detect unauthorized data exfiltration. Regular auditing of financial and client data access can also help mitigate the impact of a potential breach.