Schäfer, dein BäckerGmbH & Co. KG targeted by Akira ransomware group

• Ransomware group: Akira
• Country: Germany
• Sector: Professional Services
• Announcement date: September 26, 2024

Akira ransomware group claims data breach at Schäfer, dein BäckerGmbH & Co. KG

The Akira ransomware group has announced that it has successfully exfiltrated data from the systems of the German organization Schäfer, dein BäckerGmbH & Co. KG. According to the announcement posted on a leak site on September 26, 2024, the threat actor group claims to have obtained a significant amount of information during the attack.

The incident was reported on September 26, 2024, with the group claiming the attack occurred on the same day. The Akira group asserts that they have exfiltrated 14 GB of data from the organization. It is important to note that no screenshots were provided by the attackers to support their claims. Consequently, the specific scope and authenticity of the alleged leak have not been verified by any independent sources.

Details of the alleged data exfiltration

The claims made by the Akira group suggest that the stolen information is quite diverse in nature. According to the group's announcement, the exfiltrated data includes several sensitive categories of information that could impact various stakeholders of the organization. The specific types of data mentioned in the claim include:

• Employee personal data
• Financial data
• Partner information
• Contracts and agreements

As the group did not provide any visual evidence or screenshots of the files, the actual contents and the exact nature of the documents remain unconfirmed. The absence of such evidence is a common occurrence in many ransomware incidents, making it difficult for investigators to immediately validate the claims made by the threat actors.

About Schäfer, dein BäckerGmbH & Co. KG

Schäfer, dein Bäcker GmbH & Co. KG is a prominent bakery and food production company based in Germany. The organization operates a wide network of numerous branches, specializing in both the production and the sale of various baked goods to its customers.

Potential risks and security implications

This incident highlights the significant risks associated with the double extortion method frequently employed by ransomware groups like Akira. In a double extortion scenario, attackers not only encrypt an organization's data but also threaten to publish sensitive information on public leak sites to pressure the victim into paying a ransom. This tactic can lead to severe reputational damage through the public exposure of private corporate and personal information.

The nature of the data claimed to be stolen—including personal employee information and financial records—poses several secondary risks. For the organization's employees and business partners, the leak could facilitate identity theft or be used as a foundation for highly targeted phishing attacks. Furthermore, the exposure of contracts and partner information could lead to supply chain attacks or attempts at financial fraud. From a regulatory perspective, the potential exposure of personal data may result in violations of the General Data Protection Regulation (GDPR), which could lead to administrative sanctions for the organization.

The Akira group has demonstrated a specific tendency to exploit VPN accounts to gain initial access to networks. This behavior underscores the necessity for organizations to maintain rigorous network security processes and to continuously review their access controls. To defend against such threats, organizations often implement multi-factor authentication, monitor for unusual VPN login patterns, and maintain robust data encryption protocols. Given the limited public information available regarding the Akira group, organizations are encouraged to remain vigilant against the various risks, including potential financial fraud and secondary cyberattacks stemming from initial breaches.