Ransomware Attack Disrupts Federated Co-operatives Limited by Akira Group
Incident Date:
July 8, 2024
Overview
Title
Ransomware Attack Disrupts Federated Co-operatives Limited by Akira Group
Victim
Federated Co-operatives Limited (FCL)
Attacker
Akira
Location
First Reported
July 8, 2024
Ransomware Attack on Federated Co-operatives Limited by Akira Group
Overview of Federated Co-operatives Limited (FCL)
Federated Co-operatives Limited (FCL) is a significant co-operative federation based in Western Canada, established in 1944. It serves as a wholesaler and distributor to approximately 160 independent local co-operatives, including grocery stores, gas stations, and agricultural supply centers. FCL's unique model emphasizes collaboration, leveraging collective purchasing power to streamline operations and enhance sustainability across British Columbia, Manitoba, and the Arctic. The company operates in various sectors, including procurement and distribution, manufacturing, and marketing and administrative support.
Details of the Ransomware Attack
In late June, FCL experienced a ransomware attack that severely disrupted its internal and customer-facing systems. The attack led to significant operational disruptions, including the unavailability of online shopping and inconsistent grocery supplies in Saskatoon. FCL has since restored its corporate and local websites, although online shopping services remain down. The company is actively investigating the incident with third-party cybersecurity experts and addressing claims of potential data theft. Measures are being taken to secure systems and data and to fully restore all operations.
About the Akira Ransomware Group
The Akira ransomware group emerged in March 2023 and has rapidly grown, targeting small to medium-sized businesses across Europe, North America, and Australia. The group employs double extortion tactics, stealing data before encrypting systems and demanding ransoms ranging from $200,000 to over $4 million. Akira's dark web leak site features a retro 1980s-style interface. The group uses unauthorized access to VPNs, credential theft, and lateral movement to deploy ransomware, often utilizing tools like RClone, FileZilla, and WinSCP for data exfiltration. Akira has also expanded its operations to target Linux-based VMware ESXi virtual machines.
Potential Vulnerabilities and Penetration Methods
FCL's extensive network of independent co-operatives and its reliance on interconnected systems for procurement, distribution, and administrative support may have presented vulnerabilities. The Akira group likely exploited these vulnerabilities through unauthorized access to VPNs and credential theft. The use of tools for data exfiltration and the deployment of ransomware across both Windows and Linux systems indicate a sophisticated and well-coordinated attack strategy.
Sources
Recent Ransomware Attacks
The Recent Ransomware Attacks (RRA) site acts as a watchtower, providing you with near real-time ransomware tracking of attacks, groups and their victims. Given threat actors’ overarching, lucrative success so far, ransomware attacks have become the most ubiquitous, and financially and informationally impactful cyber threat to businesses and organizations today.
The site’s data is generated based on hosting choices of real-world threat actors, and a handful of other trackers. While sanitization efforts have been taken, we cannot guarantee 100% accuracy of the data. Attack updates will be made as source data is reported by reputable sources. By viewing, accessing, or using RRA you acknowledge you are doing so at your own risk.