Ransomware Attack on Akkanat Holding: 623.9 GB of Data Threatened
Incident Date:
August 20, 2024
Overview
Title
Ransomware Attack on Akkanat Holding: 623.9 GB of Data Threatened
Victim
Akkanat Holding
Attacker
Hunters International
Location
First Reported
August 20, 2024
Ransomware Attack on Akkanat Holding by Hunters International
Akkanat Holding, a diversified Turkish conglomerate, has recently fallen victim to a ransomware attack orchestrated by the Hunters International group. The attackers claim to have exfiltrated approximately 623.9 GB of sensitive data and have threatened to publish this data within the next 1 to 2 days if their demands are not met. This incident has put significant pressure on Akkanat Holding to respond swiftly to mitigate potential damage.
About Akkanat Holding
Established in 1990, Akkanat Holding is a multifaceted company based in Turkey, primarily known for its significant contributions to the textile industry and tourism sector. The company operates a comprehensive production chain in textile manufacturing, including fabric production and clothing design. Its textile division, Akkanat Konfeksiyon A.Ş., produces approximately 4,000 kg of fabric daily and annually manufactures around 6 million clothing pieces, employing nearly 200 staff members. The company has a strong export orientation, with a substantial portion of its products being shipped internationally.
In addition to its textile operations, Akkanat Holding has diversified its portfolio by investing in the tourism sector. The company owns and operates several luxury hotels, including the Kempinski The Dome and Sirene Hotels, as well as the Antalya Golf Club. These investments reflect Akkanat Holding's commitment to expanding its influence beyond textiles and into hospitality and leisure.
Attack Overview
The ransomware attack on Akkanat Holding was claimed by the Hunters International group via their dark web leak site. The attackers have infiltrated the organization's systems and exfiltrated a significant amount of sensitive data. The threat to publish this data within a short timeframe has created an urgent situation for Akkanat Holding, which must now navigate the complexities of responding to such a cyber threat.
About Hunters International
Hunters International is a Ransomware-as-a-Service (RaaS) group that emerged in Q3 of 2023, shortly after the disruption of the notorious Hive ransomware group. The group's ransomware code contains significant overlap with Hive ransomware, indicating a shared technical lineage. Hunters International's primary objective is to exfiltrate target data and subsequently extort victims with a ransom demand in exchange for the return of the stolen data.
Investigations have revealed potential ties to Nigeria through domain registrations and email addresses associated with the group. However, the group has also been known to use fake identities and tricky methods to conceal their true origins. Hunters International's emergence shortly after the Hive ransomware disruption has led to speculation that it is a rebranded or offshoot version of Hive, although the group denies any affiliation.
Potential Vulnerabilities
Akkanat Holding's extensive operations in both the textile and tourism sectors make it a lucrative target for ransomware groups. The company's significant data assets, including sensitive business information and customer data, present a valuable target for exfiltration and extortion. The attack highlights the importance of comprehensive cybersecurity measures, particularly for companies with diverse and expansive operations like Akkanat Holding.
Sources
Recent Ransomware Attacks
The Recent Ransomware Attacks (RRA) site acts as a watchtower, providing you with near real-time ransomware tracking of attacks, groups and their victims. Given threat actors’ overarching, lucrative success so far, ransomware attacks have become the most ubiquitous, and financially and informationally impactful cyber threat to businesses and organizations today.
The site’s data is generated based on hosting choices of real-world threat actors, and a handful of other trackers. While sanitization efforts have been taken, we cannot guarantee 100% accuracy of the data. Attack updates will be made as source data is reported by reputable sources. By viewing, accessing, or using RRA you acknowledge you are doing so at your own risk.