Ransomware Attack by Akira Group Exposes PCI Developments' Sensitive Data
Ransomware Attack on PCI Developments by Akira Group
Overview of PCI Developments
PCI Developments is a prominent real estate development and investment company based in Vancouver, British Columbia, Canada. The company has been operational for over 40 years and is known for its expertise in creating and managing a diverse portfolio of properties, including residential, commercial, and mixed-use developments. PCI Developments is particularly noted for its focus on transit-oriented developments (TODs), strategically located near public transportation hubs to promote sustainable urban living.
PCI Developments' commitment to sustainability and innovation is evident in their pursuit of LEED (Leadership in Energy and Environmental Design) certification for many of their projects. The company also engages in property management to ensure the long-term success and maintenance of their developments.
Details of the Ransomware Attack
PCI Developments recently fell victim to a ransomware attack orchestrated by the Akira ransomware group. The attackers have claimed to have obtained 570GB of data, which includes client agreements, marketing and financial files, building projects, confidential agreements and reports, as well as some personal files. This breach has significant implications for the company, given the sensitive nature of the stolen data.
About the Akira Ransomware Group
Akira is a relatively new but rapidly growing ransomware family that first emerged in March 2023. The group has been targeting small to medium-sized businesses across various sectors, including government, manufacturing, technology, education, consulting, pharmaceuticals, and telecommunications. Akira is believed to be affiliated with the now-defunct Conti ransomware gang, as their code shares similarities with Conti.
Akira operators use double extortion tactics, stealing data from victims before encrypting their systems and demanding a ransom for both decryption and data deletion. Their ransom demands typically range from $200,000 to over $4 million. The group has a unique dark web leak site with a retro 1980s-style green-on-black interface that victims must navigate by typing commands.
Penetration and Tactics
Akira's tactics include unauthorized access to VPNs, credential theft, and lateral movement to deploy the ransomware. They have also been observed using tools like RClone, FileZilla, and WinSCP for data exfiltration. In some cases, Akira has been seen deploying a previously unreported backdoor. In April 2023, Akira expanded its operations to target Linux-based VMware ESXi virtual machines in addition to Windows systems.
Given PCI Developments' extensive digital footprint and the sensitive nature of their data, they were a prime target for such an attack. The company's reliance on digital systems for managing their diverse portfolio of properties and client information made them vulnerable to the sophisticated tactics employed by the Akira group.
Implications for PCI Developments
The ransomware attack on PCI Developments underscores the growing threat of cyberattacks on the real estate sector. The stolen data, which includes client agreements and financial files, could have far-reaching consequences for the company and its clients. The breach highlights the need for robust cybersecurity measures to protect sensitive information and ensure the integrity of digital systems.
Sources
See Halcyon in action
Interested in getting a demo?
Fill out the form to meet with a Halcyon Anti-Ransomware Expert!