Toronto Zoo targeted by Akira ransomware group

• Ransomware group: Akira
• Country: Canada
• Sector: Retail & E-Commerce
• Announcement date: January 25, 2024

Akira ransomware group claims data breach at Toronto Zoo

The Akira ransomware group has officially announced a data leak, claiming to possess a significant amount of data belonging to the Toronto Zoo. According to the announcement posted on a ransomware leak site on January 25, 2024, the threat actor group asserts that they have successfully compromised the organization's network and obtained a large volume of sensitive information.

The group claims to have exfiltrated 133 GB of data from the organization's systems. In the announcement, the attackers stated their intention to release the stolen information publicly. While the group has signaled that the data will be published soon, they did not provide any screenshots to verify the contents of the stolen files at the time of the announcement.

Details of the claimed data theft

The Akira group has provided specific details regarding the types of information they claim to have stolen during the intrusion. While no visual evidence or screenshots were provided to confirm the validity of the claim, the group asserts that the stolen dataset contains highly sensitive documentation. The information reportedly includes various types of private and legal files that could be used to harm the organization or the individuals involved.

The specific types of data mentioned in the claim include:

• Non-disclosure agreements
• Confidential contracts
• Personal files such as driver's licenses

The presence of such personal identification documents, such as driver's licenses, suggests that the breach may have extended beyond corporate files into the personal information of individuals associated with the organization.

About the Toronto Zoo

The Toronto Zoo is a major zoological park located in Toronto, Canada. It is a non-profit organization that is dedicated to wildlife conservation, education, and research. The institution focuses on preserving the diversity of nature for future generations through its various programs and initiatives.

Impact and security implications of the incident

This incident, as claimed by the Akira group, may pose a significant risk of identity theft for the organization's employees and visitors due to the alleged exposure of personal files like driver's licenses. Furthermore, the exposure of confidential agreements and contracts could potentially impact the organization's business operations and its various partnerships.

From a regulatory perspective, under the PIPEDA legislation in Canada, the organization may be required to fulfill specific data breach notification obligations. The use of the double extortion method by the Akira group is a common tactic in modern ransomware attacks. In this method, attackers not only encrypt the victim's data but also steal it, threatening to leak it publicly to increase pressure on the victim to pay the ransom. This approach can facilitate secondary phishing attacks if the stolen data is eventually released to the public.

The group's known tendency to exploit VPN vulnerabilities suggests that the organization's cybersecurity infrastructure may have had potential weaknesses that were leveraged during the attack. For organizations in similar sectors, maintaining robust security protocols, such as multi-factor authentication on all remote access points and continuous monitoring of network traffic, is a critical defensive step to mitigate the risk of such intrusions.