Skira ransomware group lists City government office in Van on its leak site

• Ransomware group: Skira
• Country: Türkiye
• Sector: Government & Defense
• Announcement date: March 6, 2025

Skira ransomware group claims massive data theft from Van Metropolitan Municipality

The Skira ransomware group has listed a significant amount of data on its leak site, claiming the stolen information belongs to the Van Metropolitan Municipality in Türkiye. According to the announcement made on March 6, 2025, the threat actor group alleges it has successfully targeted the public institution, resulting in a massive data breach involving 7.4 TiB of information.

Details of the alleged attack and timeline

The threat actor known as Skira published a notice on March 6, 2025, claiming to have targeted the Van Metropolitan Municipality. The group listed 7.4 TiB of data, which it alleges was obtained from the institution's systems. This claim marks a significant escalation in the pressure placed on the local government body.

The notice provided a specific timeline regarding the potential release of the stolen information. According to the group's announcement, the data is scheduled to be leaked on May 2, 2025. This type of countdown is a common tactic used by ransomware operators to create a sense of urgency and pressure the victim organization into meeting their demands.

Data types and content involved in the leak

While information about the Skira group remains limited in the public domain, the group has specified the types of data they claim to have exfiltrated from the municipality's infrastructure. The stolen data is said to include a wide variety of critical digital assets, ranging from virtualized environments to administrative files.

The specific categories of data mentioned in the claim include:

• ESXi virtual machine data
• Application data
• Databases
• Corporate documents

The sheer volume of the claimed data suggests a comprehensive breach of the organization's digital environment, potentially impacting various administrative and operational layers.

About the Van Metropolitan Municipality

The Van Metropolitan Municipality is a public institution responsible for local government services in the Van province of Turkey. It manages municipal activities such as infrastructure, transportation, urban planning, and social services. As a central hub for regional administration, the institution handles a vast array of public-facing services and administrative functions.

Risk assessment and implications for the public sector

The alleged leak may pose a risk of exposing citizen data and administrative records held by the institution. This situation could trigger data breach notification obligations under KVKK and potentially undermine trust in the institution's digital infrastructure. Given the nature of the data, secondary risks such as identity theft or targeted phishing attacks against employees and citizens may emerge.

Furthermore, it is assessed that ransomware groups utilize such tactics to exert pressure on organizations and implement double extortion strategies. In a double extortion scenario, attackers not only encrypt an organization's data to disrupt operations but also steal sensitive information to threaten its public release. This dual-threat approach increases the leverage held by the threat actor, as the victim faces both operational downtime and the reputational damage of a public data leak.

For organizations in the government and public sector, such incidents highlight the critical importance of robust cybersecurity frameworks. Defensive strategies often include maintaining rigorous backup protocols, implementing strict access controls, and conducting regular vulnerability assessments to mitigate the risk of unauthorized access. Protecting sensitive citizen information is paramount to maintaining public trust in digital governance and ensuring the continuity of essential municipal services.