Servicio Móvil listed on Akira ransomware leak site

• Ransomware group: Akira
• Country: Spain
• Sector: Transportation
• Announcement date: November 29, 2023

Akira claims data breach at Servicio Móvil

The Akira ransomware group has officially listed the Spanish organization Servicio Móvil on its dedicated leak site. According to the announcement made on November 29, 2023, the threat actors claim to have successfully exfiltrated a significant volume of sensitive information belonging to the company. The group alleges that the attack occurred on the same day the announcement was posted, November 29, 2023.

This incident follows a pattern often observed in modern cyberattacks where threat actors use leak sites to pressure victims. In such scenarios, the group claims to have compromised the target's internal systems to steal sensitive data before encrypting files or simply threatening to release the information publicly. This tactic is a hallmark of the double-extortion method, where the goal is not just to disrupt operations through encryption, but to leverage the threat of data exposure to demand payment.

Details of the alleged data theft

The Akira group has claimed that the total volume of the exfiltrated data amounts to 114 GB. While the group has made this claim, no screenshots or specific evidence were provided in the leak site announcement to verify the contents of the stolen files. The announcement focuses on the scale of the theft rather than providing a granular breakdown of the directory structures involved.

The information allegedly stolen during this breach includes a variety of sensitive business and personal records. The data types mentioned in the claim include:

• Contracts
• Project files
• Agreements
• Client information
• Financial data

The presence of such diverse data types suggests a broad compromise of the organization's digital environment, potentially touching multiple departments from legal and finance to client relations and project management.

About Servicio Móvil

Servicio Móvil is a company based in Spain. The organization operates within the transportation sector, specifically focusing on integrated logistics services. Their professional scope also encompasses information management and business process management, making them a key player in managing complex operational workflows and data-driven logistics solutions.

Potential impact and organizational risks

The alleged breach of Servicio Móvil poses significant risks to the organization's operational continuity and its commercial reputation. Because the group is utilizing a double-extortion method, the threat of publishing the data creates a high-pressure environment for the victim. The exposure of such sensitive information can have cascading effects throughout the organization's ecosystem.

Specifically, the exposure of financial and client data could lead to secondary risks for the organization's clients. These risks include identity theft or the possibility of targeted phishing attacks directed at the clients using the stolen information. Furthermore, because the organization is based in Spain, this potential data breach may trigger legal sanctions and mandatory notification obligations under the General Data Protection Regulation (GDPR).

The impact may also extend to the organization's supply chain partners. Given the nature of logistics and business process management, the compromise of one central node can affect the security posture and data integrity of various partners connected to their network. General defensive measures for organizations in this sector often include implementing robust access controls, maintaining offline backups, and conducting regular security awareness training to mitigate the risk of initial entry by threat actors.

Information regarding the Akira group remains limited in the public domain, making it difficult to ascertain their specific long-term motives beyond the standard extortion model. As of the current reporting, the situation remains centered on the claims made by the group on their leak site.