Schottenstein Property Group Inc targeted by Akira ransomware group

• Ransomware group: Akira
• Country: United States
• Sector: Professional Services
• Announcement date: April 26, 2023

Akira ransomware group claims data breach at Schottenstein Property Group Inc

The Akira ransomware group has officially listed Schottenstein Property Group Inc on its dedicated leak site. In the announcement, the threat actors claim to have successfully compromised the company's internal systems and asserted that they are in possession of sensitive organizational data. This development follows a pattern of activity often seen in modern cyber extortion campaigns where data is used as leverage against the victim.

Details of the alleged attack

The leak announcement published by the Akira group suggests that the breach occurred around April 25, 2023, with the public listing appearing on their site on April 26, 2023. According to the claims made by the threat actors, the group has gained access to significant amounts of operational information. Specifically, the group asserts that they possess data related to 80 retail properties spanning across 23 different states. Furthermore, the attackers have indicated that this information may be released to the public in the near future, creating a sense of urgency typical of double-extortion tactics.

Double extortion is a common strategy used by ransomware groups where, after encrypting a victim's files, the attackers also steal sensitive data. The threat of leaking this data publicly serves as additional pressure to force the organization into paying the ransom. By threatening to release information that could impact business operations or privacy, the attackers aim to maximize their leverage over the target organization.

Scope of the claimed data exposure

While no screenshots were provided in the leak announcement to verify the contents of the stolen files, the Akira group claims to have acquired a variety of sensitive information types. The alleged exposure includes data that could impact both the business operations and the privacy of individuals associated with the company. The specific categories of data mentioned in the claim include:

• Customer personal data
• Corporate data

The presence of such data in the hands of threat actors can lead to significant secondary risks. For the individuals whose personal information is allegedly involved, this could result in identity theft or highly targeted phishing attacks. For the corporation, the exposure of internal files can lead to operational disruptions and significant reputational damage.

About Schottenstein Property Group Inc

Schottenstein Property Group is a real estate company involved in the investment, management, and development of retail-focused properties throughout the United States. The organization maintains a broad portfolio of commercial properties located across numerous states, making it a significant player in the retail real estate sector.

Potential implications and defensive considerations

This incident highlights the potential legal and operational repercussions that organizations face during a data breach. The alleged exposure of personal data could lead to legal consequences under various relevant data protection regulations. Furthermore, the reputational damage caused by a public data leak can be difficult for a company to recover from, especially when the leaked information is used as a tool for public shaming by the attackers.

The Akira group is known for utilizing specific techniques to gain network access, such as exploiting vulnerabilities in Virtual Private Networks (VPNs). This specific methodology underscores the importance of rigorous network security management. Organizations in the professional services and real estate sectors should prioritize the following defensive measures to mitigate such risks:

• Strengthening Remote Access: Implementing multi-factor authentication (MFA) and ensuring all VPN software is patched against known vulnerabilities.
• Data Protection Compliance: Maintaining strict adherence to data protection regulations to manage legal risks associated with data exposure.
• Network Monitoring: Continuous monitoring of network traffic to detect unauthorized access or unusual data movement early in the attack lifecycle.
• Incident Response Planning: Developing and testing comprehensive response plans to manage the fallout of both encryption and data exfiltration events.

The ultimate impact and severity of this specific incident will depend on the actual sensitivity and the true scope of the data that may have been compromised.