Thomas Greg & Sons Ltda listed on Akira ransomware leak site

• Ransomware group: Akira
• Country: Colombia
• Sector: Manufacturing
• Announcement date: November 29, 2024

Akira ransomware group targets Thomas Greg & Sons Ltda

The Akira ransomware group has officially listed Thomas Greg & Sons Ltda on its dedicated leak site. According to the announcement made on November 29, 2024, the threat actors claim to have successfully breached the organization's internal systems. This listing follows a claimed attack date of November 26, 2024, marking a targeted operation against the Colombian-based company.

The group's actions appear to follow a pattern of double extortion, a common tactic used by modern ransomware operations. In these scenarios, attackers do not merely encrypt a victim's files to disrupt operations; they also exfiltrate sensitive information. The threat actors then use the threat of leaking this stolen data on public forums to exert maximum pressure on the organization to pay a ransom. By threatening to publish private information, the attackers aim to cause reputational, legal, and operational damage that persists even if the organization can restore its systems from backups.

Claims of unauthorized data access

While no screenshots of the stolen data have been provided to verify the claims, the Akira group asserts that they have obtained a variety of sensitive internal information. The threat actors claim to be in possession of several categories of data that could be highly sensitive to both the company and the individuals involved. According to the group's announcement, the following types of information are involved:

• Financial documents
• Employee medical records
• Contact information
• Customer correspondence

The nature of these claims suggests a significant breach of privacy. The mention of medical records and financial documents indicates that the attackers may have targeted personal identifiable information (PII) alongside corporate assets. Such data is highly valued on illicit markets and serves as a potent tool for extortion.

About Thomas Greg & Sons Ltda

Thomas Greg & Sons is a manufacturing company based in Colombia. The organization specializes in high-security printing and production services, including the manufacturing of passports and identification cards. Additionally, the company provides packaging solutions and high-security document management and logistics services. Their operations serve both the public and private sectors, making them a critical provider of secure documentation and identification infrastructure.

Potential impact and industry implications

The incident involving Thomas Greg & Sons Ltda poses significant risks due to the sensitive nature of the data allegedly stolen. The potential exposure of employee medical records and financial documents increases the risk of identity theft and fraud for the affected individuals. Furthermore, the leak of customer correspondence could be leveraged by threat actors to launch secondary attacks, such as supply chain attacks or highly targeted phishing campaigns against the company's partners and clients.

Given the organization's role in producing secure government documents and identification, the incident may trigger legal proceedings under local data protection regulations. For companies operating in the manufacturing and high-security document sectors, maintaining robust cybersecurity posture is essential to protect the integrity of the supply chain and the privacy of the public. Organizations in similar sectors often prioritize defensive measures such as multi-factor authentication, network segmentation, and continuous monitoring to mitigate the risk of unauthorized access to internal systems.

General defensive considerations

To defend against the types of threats posed by groups like Akira, organizations typically focus on hardening their perimeter and internal controls. This includes implementing rigorous access management to ensure that only authorized personnel can reach sensitive financial or medical databases. Additionally, monitoring for unusual data exfiltration patterns can help detect a breach before large volumes of data are moved off-site. As ransomware groups continue to refine their double extortion methods, the ability to detect and respond to unauthorized access remains a critical component of modern cybersecurity defense.