NHPR Targeted by Akira Ransomware: Data Breach Threatens Public Radio
Incident Date:
May 31, 2024
Overview
Title
NHPR Targeted by Akira Ransomware: Data Breach Threatens Public Radio
Victim
New Hampshire Public Radio
Attacker
Akira
Location
First Reported
May 31, 2024
Ransomware Attack on New Hampshire Public Radio by Akira
Victim Overview
New Hampshire Public Radio (NHPR) is a non-profit media organization dedicated to providing news, information, and cultural programming to the residents of New Hampshire. They produce radio programs, podcasts, and online content covering a broad spectrum of topics including local news, politics, arts, and culture. As the only statewide radio news service in New Hampshire, NHPR is renowned for its high-quality, independent journalism and notable programs such as The Exchange and Word of Mouth. With a staff of 41 full-time employees, including 22 news professionals, NHPR operates on an annual budget of around $4.5 million, primarily funded by contributions from listeners, local businesses, grants, and the Corporation for Public Broadcasting.
Attack Overview
Targeted by the Akira ransomware group, New Hampshire Public Radio suffered a data breach involving the leakage of approximately 35GB of data, including financial and accounting information, grants, and other sensitive data. The ransom note left by Akira indicated their intent to publicize the organization's files on their blog.
Ransomware Group - Akira
Akira, a rapidly growing ransomware family, emerged in March 2023 and targets small to medium-sized businesses across various sectors. The group is believed to be linked with the now-defunct Conti ransomware gang and employs double extortion tactics, demanding ransom for both decryption and data deletion after stealing data from victims. Akira's ransom demands typically range from $200,000 to over $4 million. They distinguish themselves with a unique dark web leak site and continuously evolving tactics to target organizations.
Company Vulnerabilities
As a prominent media organization, New Hampshire Public Radio may have been targeted by threat actors like Akira due to its crucial role in providing news and information to the community. Vulnerabilities such as unauthorized access to VPNs, credential theft, and lateral movement to deploy ransomware could have been exploited by Akira to penetrate NHPR's systems.
Sources:
Recent Ransomware Attacks
The Recent Ransomware Attacks (RRA) site acts as a watchtower, providing you with near real-time ransomware tracking of attacks, groups and their victims. Given threat actors’ overarching, lucrative success so far, ransomware attacks have become the most ubiquitous, and financially and informationally impactful cyber threat to businesses and organizations today.
The site’s data is generated based on hosting choices of real-world threat actors, and a handful of other trackers. While sanitization efforts have been taken, we cannot guarantee 100% accuracy of the data. Attack updates will be made as source data is reported by reputable sources. By viewing, accessing, or using RRA you acknowledge you are doing so at your own risk.