Matec: Akira ransomware, likely through a UTM flaw and a misused VPN account

On 19 July 2024 the recycling company Matec in Hokkaido disclosed a ransomware attack that encrypted files on some servers. On 3 July it found encrypted files, server services partly stopped and a ransom note. Its follow-up of 13 September said a vulnerability in its UTM firmware may have been exploited and the UTM's VPN account misused to get inside. The attackers then used an administrator account with a weak password, disabled security features and deleted volume shadow copies. Traces of a file compression tool and an FTP tool on some servers suggest data may have been stolen. The ransom note identified the ransomware as Akira. Employee names, addresses and phone numbers and business partner data may have leaked.