Hacker group Akira extorts Swiss Federal Government following Publica data theft
Following the data theft from Publica supplier PK Softech, hacker group Akira has demanded a ransom from the Swiss Federal Government. The Federal Council has discussed the case, but officially states it will not pay.
Akira apparently directs ransom demand directly at the Federal Government
Hacker group Akira has demanded a ransom following the theft of sensitive Publica data and is threatening to publish the information or resell it. This is reported by Tages-Anzeiger citing SRF research based on multiple sources. The Federal Department of Defence, Civil Protection and Sport (VBS) is informed of the extortion attempt.
It remains unclear to whom exactly the demand is directed. The hacked IT company PK Softech and the federal pension fund Publica told SRF that they had received no ransom demand. Nicolas Mayencourt, founder of cybersecurity firm Dreamlab Technologies, draws a conclusion from this: "The obvious conclusion is that the perpetrators have lodged their ransom demand directly with the Federal Government."
VBS merely confirmed to SRF its general recommendation not to pay ransom. It did not comment on the specific case. Federal Council spokeswoman Nicole Lamon, however, confirmed: "The Federal Council discussed Publica last Wednesday. It will provide no further information on this matter."
Data of over one hundred thousand federal employees affected
The responsible federal agencies assume that data from well over one hundred thousand current and former federal employees has leaked. Those potentially affected could also include intelligence service employees, fedpol staff, elite soldiers and former federal councillors.
The stolen datasets contain names, dates of birth, social insurance numbers, private and business addresses and salary information. Some also include bank details, telephone numbers, email addresses, information on civil status and details about partners and children.
The data was stored on a server belonging to Basel-Landschaft company PK Softech, a Publica supplier. It should not have been there: PK Softech had confirmed in writing to Publica in January that it had deleted legacy data from 2019. Publica had demanded this deletion following a cyber attack on software provider Xplain. Why the data was nevertheless retained is the subject of ongoing investigations. PK Softech left this question unanswered.
Ruag paid ransom following previous Akira attack
The case is particularly sensitive for the Federal Government. The Federal Office of Cybersecurity generally recommends those affected not to pay ransom and to have no contact with perpetrators. However, this line had already been crossed: Last summer it became known that the state-owned defence company Ruag had paid ransom to Akira following an attack on its US subsidiary. VBS criticised Ruag at the time because it had "not sufficiently taken into account political and reputational impacts as well as broader overarching interests".
Cyber expert Mayencourt warns that any payment finances the extortionists' business model: "If it becomes known that Swiss authorities pay, the attackers are likely to intensify their efforts and seek further targets," he told SRF. The broadcaster has no evidence that negotiations or payments have actually taken place in the Publica case so far.
No publication of data — three possible explanations
More than a month after the attack, Akira has not published the stolen data. For Mayencourt, this is unusual. He lists three possible explanations: ransom could have been paid, Akira could have already sold the data, or negotiations could be deliberately being drawn out for tactical reasons.
Source: Tages-Anzeiger