Thong Sia listed on Akira ransomware leak site

• Ransomware group: Akira
• Country: Singapore
• Sector: Retail & E-Commerce
• Announcement date: February 17, 2025

Thong Sia targeted by Akira ransomware group

Thong Sia has been listed on the Akira ransomware group's leak site, with claims that the organization's sensitive data has been compromised. The announcement, made on February 17, 2025, indicates that the threat actor group has targeted the Singapore-based organization, claiming to have gained unauthorized access to various corporate documents.

The Akira group is a known ransomware entity that frequently employs double-extortion tactics to pressure their victims. In a double-extortion scheme, attackers do not merely encrypt an organization's systems to disrupt operations; they also exfiltrate sensitive data before the encryption phase. The threat of leaking this stolen information on a public leak site serves as additional leverage to coerce the victim into paying a ransom. This method increases the pressure on the target, as the threat of public exposure can lead to significant reputational and legal consequences.

Details of the claimed data breach

According to the announcement made by the Akira group, the breach involves a wide array of sensitive information. While the group has not provided any screenshots to support their claims, they assert that they have accessed and intend to leak various types of data belonging to the organization. The specific categories of information allegedly compromised include:

• Financial data
• Audit reports
• Payment details
• Passports
• Employee data
• Customer data
• Contact information
• Email addresses

It is important to note that the group has not provided information regarding the total size of the data stolen or the specific file count involved in this incident. Furthermore, no ransom demand has been publicly stated by the attackers in this specific listing.

About Thong Sia

Thong Sia Group is a prominent entity operating within the retail and e-commerce sector. The company serves as the sole distributor for several well-known watch brands, including Seiko, Lorus, Alba, and Wired. Their distribution network covers multiple regions, specifically Hong Kong, Malaysia, Brunei, Singapore, and Macau. Operating under the Stelux Group, Thong Sia specializes in the distribution of watches and various timekeeping equipment.

Risk assessment and implications

This incident may increase the risk of identity theft or targeted phishing attacks against Thong Sia employees and customers. The alleged compromise of financial data and passport information could negatively impact the organization's commercial reputation and operational security. Because the organization operates in Singapore, it is likely that legal processes under the Personal Data Protection Act (PDPA) may be triggered as a result of this alleged exposure.

Given the known tactics of the Akira group, the leaked data could potentially be used for secondary attacks or offered for sale on the dark web. This creates a persistent threat where the stolen information remains a tool for criminals long after the initial breach. Additionally, the incident may pose an indirect risk to the organization's supply chain partners, who may be targeted due to their business relationships with Thong Sia.

For organizations in the retail and distribution sectors, maintaining robust security postures is essential to mitigate such risks. Common defensive steps include implementing multi-factor authentication (MFA) across all corporate accounts, maintaining regular offline backups of critical data, and conducting frequent security awareness training to help employees recognize phishing attempts. Furthermore, monitoring for unauthorized data exfiltration and ensuring strict access controls can help reduce the potential impact of a successful breach.