Ransomware Attack by Akira Group Exposes PCI Developments' Sensitive Data
Incident Date:
June 25, 2024
Overview
Title
Ransomware Attack by Akira Group Exposes PCI Developments' Sensitive Data
Victim
PCI Developments
Attacker
Akira
Location
First Reported
June 25, 2024
Ransomware Attack on PCI Developments by Akira Group
Overview of PCI Developments
PCI Developments is a prominent real estate development and investment company based in Vancouver, British Columbia, Canada. The company has been operational for over 40 years and is known for its expertise in creating and managing a diverse portfolio of properties, including residential, commercial, and mixed-use developments. PCI Developments is particularly noted for its focus on transit-oriented developments (TODs), strategically located near public transportation hubs to promote sustainable urban living.
PCI Developments' commitment to sustainability and innovation is evident in their pursuit of LEED (Leadership in Energy and Environmental Design) certification for many of their projects. The company also engages in property management to ensure the long-term success and maintenance of their developments.
Details of the Ransomware Attack
PCI Developments recently fell victim to a ransomware attack orchestrated by the Akira ransomware group. The attackers have claimed to have obtained 570GB of data, which includes client agreements, marketing and financial files, building projects, confidential agreements and reports, as well as some personal files. This breach has significant implications for the company, given the sensitive nature of the stolen data.
About the Akira Ransomware Group
Akira is a relatively new but rapidly growing ransomware family that first emerged in March 2023. The group has been targeting small to medium-sized businesses across various sectors, including government, manufacturing, technology, education, consulting, pharmaceuticals, and telecommunications. Akira is believed to be affiliated with the now-defunct Conti ransomware gang, as their code shares similarities with Conti.
Akira operators use double extortion tactics, stealing data from victims before encrypting their systems and demanding a ransom for both decryption and data deletion. Their ransom demands typically range from $200,000 to over $4 million. The group has a unique dark web leak site with a retro 1980s-style green-on-black interface that victims must navigate by typing commands.
Penetration and Tactics
Akira's tactics include unauthorized access to VPNs, credential theft, and lateral movement to deploy the ransomware. They have also been observed using tools like RClone, FileZilla, and WinSCP for data exfiltration. In some cases, Akira has been seen deploying a previously unreported backdoor. In April 2023, Akira expanded its operations to target Linux-based VMware ESXi virtual machines in addition to Windows systems.
Given PCI Developments' extensive digital footprint and the sensitive nature of their data, they were a prime target for such an attack. The company's reliance on digital systems for managing their diverse portfolio of properties and client information made them vulnerable to the sophisticated tactics employed by the Akira group.
Implications for PCI Developments
The ransomware attack on PCI Developments underscores the growing threat of cyberattacks on the real estate sector. The stolen data, which includes client agreements and financial files, could have far-reaching consequences for the company and its clients. The breach highlights the need for robust cybersecurity measures to protect sensitive information and ensure the integrity of digital systems.
Sources
Recent Ransomware Attacks
The Recent Ransomware Attacks (RRA) site acts as a watchtower, providing you with near real-time ransomware tracking of attacks, groups and their victims. Given threat actors’ overarching, lucrative success so far, ransomware attacks have become the most ubiquitous, and financially and informationally impactful cyber threat to businesses and organizations today.
The site’s data is generated based on hosting choices of real-world threat actors, and a handful of other trackers. While sanitization efforts have been taken, we cannot guarantee 100% accuracy of the data. Attack updates will be made as source data is reported by reputable sources. By viewing, accessing, or using RRA you acknowledge you are doing so at your own risk.