NHPR Targeted by Akira Ransomware: Data Breach Threatens Public Radio
Ransomware Attack on New Hampshire Public Radio by Akira
Victim Overview
New Hampshire Public Radio (NHPR) is a non-profit media organization dedicated to providing news, information, and cultural programming to the residents of New Hampshire. They produce radio programs, podcasts, and online content covering a broad spectrum of topics including local news, politics, arts, and culture. As the only statewide radio news service in New Hampshire, NHPR is renowned for its high-quality, independent journalism and notable programs such as The Exchange and Word of Mouth. With a staff of 41 full-time employees, including 22 news professionals, NHPR operates on an annual budget of around $4.5 million, primarily funded by contributions from listeners, local businesses, grants, and the Corporation for Public Broadcasting.
Attack Overview
Targeted by the Akira ransomware group, New Hampshire Public Radio suffered a data breach involving the leakage of approximately 35GB of data, including financial and accounting information, grants, and other sensitive data. The ransom note left by Akira indicated their intent to publicize the organization's files on their blog.
Ransomware Group - Akira
Akira, a rapidly growing ransomware family, emerged in March 2023 and targets small to medium-sized businesses across various sectors. The group is believed to be linked with the now-defunct Conti ransomware gang and employs double extortion tactics, demanding ransom for both decryption and data deletion after stealing data from victims. Akira's ransom demands typically range from $200,000 to over $4 million. They distinguish themselves with a unique dark web leak site and continuously evolving tactics to target organizations.
Company Vulnerabilities
As a prominent media organization, New Hampshire Public Radio may have been targeted by threat actors like Akira due to its crucial role in providing news and information to the community. Vulnerabilities such as unauthorized access to VPNs, credential theft, and lateral movement to deploy ransomware could have been exploited by Akira to penetrate NHPR's systems.
Sources:
See Halcyon in action
Interested in getting a demo?
Fill out the form to meet with a Halcyon Anti-Ransomware Expert!