Automation Tool & Die Faces Ransomware Threat from Akira Group
Ransomware Attack on Automation Tool & Die by Akira Group
Automation Tool & Die, Inc. (ATD), a prominent player in the manufacturing sector, recently fell victim to a ransomware attack orchestrated by the notorious Akira group. This incident, which occurred on November 21, 2024, has raised significant concerns about cybersecurity vulnerabilities within the manufacturing industry.
Company Profile and Industry Standing
Founded in 1974, Automation Tool & Die is renowned for its expertise in custom metal stamping and precision tooling solutions. Operating from a 105,000-square-foot facility in Valley City, Ohio, ATD serves a diverse clientele, including Tier 1 and Tier 2 automotive suppliers. The company is distinguished by its commitment to quality, underscored by its IATF 16949 certification, and its innovative use of advanced CAD and CAM software. With a workforce of 50 to 99 employees, ATD has maintained a remarkable 100% customer retention rate over the past decade, highlighting its reliability and customer-centric approach.
Attack Overview
The Akira ransomware group targeted ATD, compromising approximately 17GB of sensitive internal data. This breach included employee contacts, confidential agreements, NDAs, and personal information such as email addresses and phone numbers. The attackers have threatened to release this data unless their ransom demands are met, placing ATD in a precarious position.
About the Akira Ransomware Group
Emerging in March 2023, Akira operates as a Ransomware-as-a-Service (RaaS) entity, employing a double extortion model. The group is known for its sophisticated encryption techniques and cross-platform capabilities, including a Rust-based variant for Linux and VMware ESXi environments.
Potential Vulnerabilities and Attack Vectors
Akira's penetration into ATD's systems likely involved exploiting vulnerabilities in VPN credentials or unpatched software, common entry points for ransomware attacks. The group's use of spear-phishing and exploitation of known vulnerabilities in Cisco ASA and FortiClient underscores the importance of effective cybersecurity measures. ATD's reliance on advanced technology and its significant data assets made it an attractive target for Akira, which prioritizes sectors with critical operational dependencies.
Sources
See Halcyon in action
Interested in getting a demo?
Fill out the form to meet with a Halcyon Anti-Ransomware Expert!