Vodotehnika D.D. listed on Akira ransomware leak site

• Ransomware group: Akira
• Country: Croatia
• Sector: Retail & E-Commerce
• Announcement date: January 17, 2025

The Akira ransomware group has officially listed the Croatian company Vodotehnika D.D. on its dedicated leak site. Through this announcement, the threat actors claim to have successfully breached the organization's internal systems and exfiltrated various types of corporate documentation.

The details of the alleged attack

According to the announcement made on January 17, 2025, the Akira group claims to have gained unauthorized access to the internal systems of Vodotehnika D.D. This intrusion reportedly allowed the threat actors to extract sensitive information from the company's network. While the group's listing appeared in mid-January, the claim suggests that the initial access may have occurred around December 3, 2024.

The Akira group has been an active presence in the cyber threat landscape since early 2023. This group is recognized for its use of double-extortion tactics, a method where attackers not only encrypt an organization's data to disrupt operations but also steal sensitive information to threaten its public release. This dual-layered approach is designed to maximize pressure on the victim, as the threat of a data leak serves as a powerful lever to compel the organization into paying a ransom.

Security researchers have noted that the Akira group frequently targets vulnerabilities within Virtual Private Networks (VPNs) to gain their initial foothold in a target network. By exploiting these entry points, they can bypass perimeter defenses and move laterally through the organization's infrastructure to locate and exfiltrate high-value data.

The types of data claimed to be stolen

The threat actor has provided specific details regarding the nature of the information they claim to have stolen from Vodotehnika D.D. Although no screenshots were provided by the group to verify the contents of the stolen files, the claims specify that the exfiltrated data includes highly sensitive materials. These include internal financial documents and various forms of personally identifiable information belonging to both employees and customers.

The following data types are reportedly included in the breach:

• Financial documents
• Employee contact information
• Customer contact information
• Passport and identity documents

About Vodotehnika D.D.

Vodotehnika D.D. is an organization based in Croatia. The company operates within the retail and e-commerce sector, specifically focusing on the design, production, and retail of home equipment and decor. In addition to providing these physical products, the company also offers various support services related to its product line.

Implications and potential risks

The alleged leak of such sensitive information poses significant secondary risks to the individuals involved. The theft of contact information, passports, and identity documents can lead to identity theft and makes employees and customers targets for highly specific, targeted phishing attacks. When attackers possess detailed personal data, they can craft much more convincing social engineering campaigns to further exploit victims.

Furthermore, because the alleged data includes personal information, the organization may face legal repercussions under the General Data Protection Regulation (GDPR) due to potential violations of data privacy laws. The nature of the data suggests a high level of risk to the privacy of the data subjects.

In response to such incidents, organizations typically find it necessary to initiate a comprehensive forensic investigation. Such an investigation is essential to determine the full scope of the breach and to understand exactly how the attackers gained access. Additionally, organizations are often required to notify relevant data protection authorities and the affected individuals to comply with regulatory requirements and mitigate further harm.