Permoda listed on Akira ransomware leak site

• Ransomware group: Akira
• Country: Panama
• Sector: Manufacturing
• Announcement date: January 9, 2025

Akira ransomware group claims data breach against Permoda

The Akira ransomware group has listed the organization Permoda on its dedicated leak site. According to the announcement made by the threat actors, the group claims to have obtained a significant volume of corporate information, specifically totaling 220 GB of data. This claim was published on January 9, 2025, coinciding with the date the group alleges the attack took place.

The Akira group is known to employ double extortion tactics during their operations. In a double extortion scheme, attackers do not merely encrypt an organization's systems to disrupt operations; they also exfiltrate sensitive data before the encryption process begins. This allows the group to exert pressure on the victim by threatening to leak the stolen information on public leak sites if a ransom is not paid. While information regarding the specific technical methods used by this group remains limited, it is frequently reported that they gain initial access to networks by exploiting vulnerabilities in VPN accounts.

Details of the alleged data theft

The announcement made by the Akira group suggests that the stolen information consists of various private corporate documents. Although no screenshots were provided by the attackers to verify the contents of the breach, the group claims that the stolen data includes a wide range of sensitive materials. The alleged contents of the 220 GB data set include:

• Employee contact information
• Customer contact information
• Financial documents
• Confidential agreements
• Contracts
• Certification documents

The presence of such diverse data types, ranging from personal contact details to high-level corporate agreements, highlights the potential impact of the alleged incident on the organization's internal and external operations.

About Permoda

Permoda is a prominent retail company based in Colombia that specializes in the production, manufacturing, and distribution of textile products. The company operates under the KOAJ brand and maintains a significant presence across several regions, including Colombia, Costa Rica, Ecuador, and Panama.

Potential implications and defensive considerations

The alleged exposure of this data carries significant risks for both the organization and the individuals involved. For employees and customers, the theft of contact information increases the likelihood of identity theft and the execution of targeted phishing attacks. For the company itself, the potential leak of internal financial documents and confidential contracts could lead to substantial harm to its business operations and its competitive standing in the market.

Because Permoda is a company based in Panama, this incident may involve complex legal implications under local data protection laws as well as international regulatory standards. When an organization faces a breach of this nature, it often requires a comprehensive forensic investigation to determine the true scope of the intrusion and to identify exactly what was accessed by the threat actors. Furthermore, organizations in the manufacturing and retail sectors typically must follow protocols to notify affected parties once a breach is confirmed.

To defend against the tactics used by groups like Akira, organizations often focus on securing remote access points. Since VPN exploitation is a common entry vector, implementing multi-factor authentication (MFA) and strictly monitoring VPN logs for unusual activity are standard defensive measures. Additionally, maintaining robust data encryption and implementing strict access controls can help limit the amount of sensitive information available to an attacker even if they manage to penetrate the network perimeter.