Tampa State Bank targeted by Akira ransomware group

• Ransomware group: Akira
• Country: United States
• Sector: Financial Services
• Announcement date: November 20, 2024

Akira ransomware group claims data breach at Tampa State Bank

The Akira ransomware group has listed data allegedly belonging to Tampa State Bank on its leak site. In an announcement dated November 20, 2024, the group claimed to have compromised the internal corporate data of the institution. According to the claims made by the threat actors, approximately 13 GB of data is currently prepared for publication on their platform.

Details of the alleged data theft

The announcement made by the Akira group suggests that the stolen information is substantial in scope. While the group has not provided any screenshots to verify the contents of the stolen files, they claim that the data includes a variety of sensitive information. The types of data allegedly compromised include:

• Financial information
• Driver licenses
• SSNs
• Employee contact details

The group has not provided information regarding the specific file count or the amount of the ransom demand requested in this instance. The announcement serves as a notification of a data leak rather than a direct negotiation attempt in the provided details.

About Tampa State Bank

Tampa State Bank is a local financial institution that has been providing full-service banking in Tampa and Marion, Kansas, for over 100 years. As a long-standing entity in the financial services sector, the institution serves the local communities of Kansas through various banking services.

Impact and security implications

This alleged data breach may increase the risk of identity theft and fraud for both employees and customers. The exposure of sensitive financial data could damage the institution's reputation and lead to legal proceedings under US state laws and federal regulations. The Akira group's use of the double-extortion method may be intended to pressure the institution by threatening to publish the sensitive data online.

In such scenarios, organizations often face significant pressure to fulfill data breach notification obligations and must inform all affected parties. While information about the Akira group remains limited, it has been observed in similar attacks that VPN vulnerabilities have been utilized to gain access to networks.

For organizations operating within the financial services sector, such incidents highlight the critical importance of robust defensive measures. Common defensive steps for organizations include maintaining rigorous patch management to address vulnerabilities in remote access tools, such as VPNs, and implementing strong multi-factor authentication across all entry points. Furthermore, monitoring for unauthorized data exfiltration and maintaining comprehensive incident response plans are essential components of a modern cybersecurity posture to mitigate the impact of ransomware and potential double-extortion tactics.