Ransomware Attack Exposes 11GB of Data at Beckett Thermal Solutions
Incident Date:
June 25, 2024
Overview
Title
Ransomware Attack Exposes 11GB of Data at Beckett Thermal Solutions
Victim
Beckett Thermal Solutions
Attacker
Akira
Location
First Reported
June 25, 2024
Ransomware Attack on Beckett Thermal Solutions by Akira Group
Overview of Beckett Thermal Solutions
Beckett Thermal Solutions is a leading manufacturer specializing in heating components and systems. Established in 1937, the company has a rich history of innovation in combustion technologies. Their product range includes advanced burners, igniters, controls, and other critical components for residential, commercial, and industrial heating systems. Beckett Thermal Solutions is renowned for its focus on fuel efficiency, low emissions, and high-quality engineering standards.
Details of the Ransomware Attack
On June 26, 2024, Beckett Thermal Solutions was targeted by a ransomware attack executed by the Akira ransomware group. The attack led to a significant data breach, compromising 11GB of sensitive information. The stolen data includes numerous project files and personal information of employees, such as names, addresses, and emails. This breach has raised serious concerns about the security measures at Beckett Thermal Solutions and the potential impact on their operations and reputation.
About the Akira Ransomware Group
Akira is a relatively new but rapidly growing ransomware family that first appeared in March 2023. The group targets small to medium-sized businesses across various sectors, including manufacturing, technology, and telecommunications. Akira is believed to be linked to the now-defunct Conti ransomware gang, sharing similarities in their code. The group uses double extortion tactics, stealing data before encrypting systems and demanding a ransom for both decryption and data deletion. Their ransom demands typically range from $200,000 to over $4 million.
How Akira Distinguishes Itself
Akira's unique dark web leak site features a retro 1980s-style green-on-black interface, requiring victims to navigate by typing commands. The group employs sophisticated tactics, including unauthorized access to VPNs, credential theft, and lateral movement within networks. They have been observed using tools like RClone, FileZilla, and WinSCP for data exfiltration. In some cases, Akira has deployed a previously unreported backdoor, further complicating detection and mitigation efforts.
Potential Vulnerabilities Exploited
While specific details about how Akira penetrated Beckett Thermal Solutions' systems are not publicly available, common vulnerabilities exploited by ransomware groups include weak or compromised credentials, unpatched software, and inadequate network segmentation. Given Akira's known tactics, it is likely that they gained initial access through compromised VPN credentials or exploited vulnerabilities in Beckett Thermal Solutions' network infrastructure.
Impact on Beckett Thermal Solutions
The ransomware attack on Beckett Thermal Solutions has significant implications for the company. The breach of 11GB of sensitive data not only poses a risk to their intellectual property and competitive advantage but also affects the personal information of their employees. The attack underscores the importance of robust cybersecurity measures and the need for continuous monitoring and improvement of security protocols to protect against evolving threats.
Sources
Recent Ransomware Attacks
The Recent Ransomware Attacks (RRA) site acts as a watchtower, providing you with near real-time ransomware tracking of attacks, groups and their victims. Given threat actors’ overarching, lucrative success so far, ransomware attacks have become the most ubiquitous, and financially and informationally impactful cyber threat to businesses and organizations today.
The site’s data is generated based on hosting choices of real-world threat actors, and a handful of other trackers. While sanitization efforts have been taken, we cannot guarantee 100% accuracy of the data. Attack updates will be made as source data is reported by reputable sources. By viewing, accessing, or using RRA you acknowledge you are doing so at your own risk.