Volo Internet Tech listed on Akira ransomware leak site

• Ransomware group: Akira
• Country: United States
• Sector: Technology
• Announcement date: November 20, 2024

Akira ransomware group targets Volo Internet Tech

The Akira ransomware group has officially listed the United States-based organization Volo Internet Tech on its dedicated leak site. According to the announcement made on November 20, 2024, the threat actors claim to have targeted the company, asserting that they have obtained a significant volume of internal corporate data. This development follows an alleged attack date of July 28, 2024, suggesting that the attackers may have maintained presence within the network for several months prior to the public announcement.

The listing serves as a public declaration of the group's intent to publish the stolen information. This tactic is a hallmark of modern ransomware operations, where the goal is not merely to encrypt files for a ransom, but to use the threat of data exposure as a secondary lever for coercion. By announcing the breach on a public platform, the group aims to exert maximum pressure on the victim organization to meet their demands.

Details of the claimed data theft

While no screenshots were provided in the leak site announcement to verify the contents of the stolen files, the Akira group has made specific claims regarding the nature of the information they have acquired. The group asserts that they have successfully exfiltrated approximately 49 GB of internal corporate data. This volume of data suggests a broad sweep of the organization's digital environment, potentially encompassing various administrative and operational repositories.

The threat actors claim that the stolen dataset contains highly sensitive information that could be used to harm both the organization and the individuals associated with it. According to the listing, the following types of data are included in the breach:

• Social Security Numbers (SSN)
• Non-disclosure agreements
• Passport information
• Driver license information

The inclusion of such sensitive personal identifiers increases the potential impact of the breach, as these details are frequently used in identity theft and fraudulent activities.

About Volo Internet Tech

Volo Internet Tech is an internet service provider that has been operating since 2001. Based in the United States, the company specifically serves the Illinois region. The organization focuses on providing fast and accessible internet services to its local customer base, making it a vital utility for the communities it serves.

Risk assessment and industry implications

The alleged exposure of sensitive personal and corporate data carries significant risks. For the individuals whose information was purportedly stolen, the risk of identity theft is heightened due to the nature of the data, which includes government-issued identifiers like passports and driver licenses. For the organization, the incident could lead to severe reputational damage and a loss of customer trust if the data is indeed released to the public.

Furthermore, because the organization is based in the United States, this incident could trigger complex legal processes involving both state-level data protection laws and federal regulations. There is also the risk that the leaked information could be utilized by the attackers or other malicious actors in targeted phishing campaigns, using the stolen context to deceive employees or customers.

The Akira group, which has been active since early 2023, is known for frequently exploiting vulnerabilities in Virtual Private Networks (VPNs) to gain initial access to corporate networks. This incident highlights the ongoing necessity for organizations in the technology and service provider sectors to maintain rigorous security postures. To defend against such threats, organizations typically focus on hardening remote access points, implementing multi-factor authentication, and maintaining robust data encryption protocols to mitigate the impact of potential exfiltration.

The mechanics of double extortion

The tactics employed by the Akira group in this instance appear to follow the double extortion model. In this scenario, attackers do not stop at encrypting a company's systems to disrupt operations; they also focus on stealing sensitive data to use as leverage. Even if an organization has strong backups to restore their systems, the threat of leaking private customer data or proprietary corporate documents creates a powerful incentive for the victim to comply with ransom demands. This method significantly increases the pressure on leadership to resolve the incident quickly to avoid public disclosure and the subsequent regulatory and legal fallout.