Akira Ransomware Strikes Apache OpenOffice, Allegedly Exfiltrates 23GB of Data

The notorious Akira ransomware gang announced on October 29, 2025, that it successfully penetrated the systems of Apache OpenOffice, claiming to have exfiltrated a staggering 23 gigabytes of sensitive corporate data.

The group posted details on its dark web leak site, threatening to release the stolen information unless a ransom demand is met.

This incident represents a significant escalation in cyber threats targeting even non-profit software foundations, raising serious concerns about the security posture of organizations that serve millions of users worldwide.

Apache OpenOffice stands as a cornerstone of free office productivity software, developed under the Apache Software Foundation as a community-driven alternative to commercial suites like Microsoft Office.

The platform has maintained a loyal user base spanning millions of individuals across education, small businesses, nonprofits, and enterprises globally.

The software suite includes Writer for word processing, Calc for spreadsheets, Impress for presentations, Draw for vector graphics, Base for databases, and Math for mathematical formulas, with support for over 110 languages across Windows, Linux, and macOS platform. The project relies heavily on volunteer contributors and community funding to sustain development.

Scope of the Alleged Breach

According to Akira’s claims, the stolen data encompasses highly personal employee records including physical addresses, phone numbers, dates of birth, driver’s licenses, Social Security numbers, and credit card details.

The group also claims to have obtained financial records, internal confidential documents, and extensive reports detailing application bugs and development issues.

Akira boasted on its leak site that it would “upload 23 GB of corporate documents soon,” emphasizing the breadth of the intrusion into the foundation’s operational systems.

The alleged theft highlights the vulnerability of organizations managing sensitive employee and operational data, even when they operate as non-profit entities serving the greater good.

If the data proves authentic, it could fuel identity theft, phishing campaigns, and social engineering attacks targeting Apache Software Foundation staff members.

However, the open-source nature of OpenOffice limits direct risks to the software’s codebase, meaning end-user installations and the public download servers remain uncompromised at this time.

Response and Ongoing Concerns

As of November 1, 2025, the Apache Software Foundation has neither confirmed nor denied the breach, with spokespeople declining immediate comment to cybersecurity outlets.

Independent verification of the stolen data remains elusive, raising questions about whether the materials are genuinely fresh or potentially repurposed from prior leaks.

The silence from the foundation has left many in the cybersecurity community waiting for official clarification or evidence of the breach’s authenticity.

Akira, a ransomware-as-a-service operation that emerged in March 2023, has established itself as one of the most active threat actors in the criminal landscape.

The group has amassed tens of millions in ransoms through hundreds of attacks spanning the United States, Europe, and beyond.

Known for employing aggressive double-extortion tactics, Akira deploys variants for both Windows and Linux/ESXi environments and has gained notoriety for hacking victim webcams to extract additional leverage during negotiations.

This incident exemplifies the rising tide of ransomware attacks targeting open-source projects, prompting calls for enhanced security measures within volunteer-driven software ecosystems.

Organizations using Apache OpenOffice should implement robust monitoring protocols to detect suspicious activity and ensure data backups remain isolated from production systems.

As Akira’s listing persists without resolution, the cybersecurity community remains vigilant, awaiting definitive proof of the breach or evidence of negotiation between the attackers and the foundation.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.