Apache OpenOffice Disputes Akira Ransomware Data Breach Claims: No Evidence Found of Compromise

Executive Summary

On October 30, 2025, the Akira ransomware gang publicly claimed to have breached the Apache OpenOffice project, alleging the theft of 23GB of sensitive corporate data, including employee and financial information. The Apache Software Foundation (ASF), which oversees Apache OpenOffice, has categorically disputed these claims, stating that the project does not possess the types of data described by the attackers and that no evidence of compromise has been found. As of November 5, 2025, no data has been leaked, no ransom demand has been received, and no law enforcement or regulatory notifications have been made. All available evidence from primary sources supports the ASF’s position that no breach has occurred. This report provides a comprehensive technical analysis of the incident, the threat actor’s historical tactics, and the evidence assessment supporting these conclusions.

Technical Information

Apache OpenOffice is a free, open-source office productivity suite managed by the Apache Software Foundation. On October 30, 2025, the Akira ransomware gang listed Apache OpenOffice as a victim on its data leak site, claiming to have exfiltrated 23GB of data, including employee personal information, financial records, and internal documents (BleepingComputer, 2025-11-04; Ransomware.live, 2025-11-05; Breachsense, 2025-10-31). The Akira group’s statement included specific references to employee addresses, phone numbers, dates of birth, driver licenses, social security cards, credit card information, financial data, and confidential internal files.

The Apache Software Foundation responded by stating that the project does not have paid employees or centralized HR or financial data, as all contributors are volunteers. The ASF further clarified that all bug reports and feature requests are public, and the types of confidential data described by Akira do not exist within the project’s infrastructure. The Foundation has not received a ransom demand, has not contacted law enforcement, and has not engaged cybersecurity experts, citing a lack of evidence for any compromise (BleepingComputer, 2025-11-04).

Technical analysis of the incident reveals no published indicators of compromise (IOCs), such as malicious binaries, ransom notes, or forensic artifacts. No data samples or proof-of-leak have been posted by Akira or discovered by third-party researchers. The only evidence supporting the breach claim is the Akira gang’s public statement, which remains unsubstantiated by any technical or circumstantial data.

Historically, the Akira ransomware group has targeted organizations in sectors such as education, manufacturing, finance, and government, primarily in North America, the UK, and Australia (CISA Advisory AA24-109A; Qualys Blog). Akira’s typical attack chain involves initial access via compromised credentials for VPN or RDP, privilege escalation using tools like Mimikatz and LaZagne, lateral movement with utilities such as Advanced IP Scanner and AdFind, data exfiltration using WinRAR and Rclone, and double extortion tactics. However, there is no evidence that any of these techniques were used against Apache OpenOffice in this case.

The open-source nature of Apache OpenOffice means that sensitive HR and financial data are not centrally stored, and all project communications are conducted transparently via public mailing lists. This structure is atypical for Akira’s usual targets, which are organizations with valuable, regulated, or sensitive data. The ASF’s public statements and the absence of leaked data or technical artifacts further support the conclusion that the breach claim is unsubstantiated.

Affected Versions & Timeline

The Akira ransomware gang’s claim references the Apache OpenOffice project as a whole, without specifying any particular version. The project is open-source and does not maintain centralized user or contributor data. The following timeline summarizes the key events:

October 30, 2025: The Akira ransomware gang claims to have breached Apache OpenOffice and exfiltrated 23GB of data (BleepingComputer, 2025-11-04; Ransomware.live, 2025-11-05).

October 31, 2025: Breachsense lists the alleged breach, confirming the claim and the purported data size (Breachsense, 2025-10-31).

November 4, 2025: The Apache Software Foundation issues a public statement disputing the claims and confirming no evidence of breach (BleepingComputer, 2025-11-04).

November 5, 2025: Ransomware.live updates its dataset, with no leaked data posted and no further developments (Ransomware.live, 2025-11-05).

No specific versions of Apache OpenOffice are implicated, and no user or contributor data is believed to be at risk.

Threat Activity

The Akira ransomware gang is a financially motivated threat actor active since March 2023, known for double extortion tactics—exfiltrating data before encrypting files and threatening to leak the data if ransom is not paid (MITRE ATT&CK G1024). Akira typically gains initial access through compromised credentials for VPN or RDP, escalates privileges using credential dumping tools such as Mimikatz and LaZagne, and moves laterally using network scanning and Active Directory enumeration tools. Data is exfiltrated using utilities like WinRAR and Rclone, and the group often deletes administrative accounts to impede recovery.

In this incident, Akira’s claim is limited to a public statement on its leak site, with no technical evidence or proof-of-leak provided. The group’s description of the allegedly stolen data is inconsistent with the structure and operations of an open-source project like Apache OpenOffice, which does not maintain centralized HR or financial records. The ASF’s transparent development model and lack of paid employees further undermine the credibility of the claim.

No technical indicators of compromise, malware samples, or ransom notes have been published or detected by third-party researchers. The absence of leaked data, combined with the ASF’s public denial and lack of regulatory or law enforcement notifications, indicates that the threat activity is likely limited to an unsubstantiated extortion attempt rather than a confirmed breach.

Mitigation & Workarounds

Based on the current evidence, there is no indication that Apache OpenOffice or its users are at risk from this specific incident. However, organizations using open-source software projects should continue to follow best practices for supply chain security and incident response. The following recommendations are prioritized by severity:

Critical: No critical mitigations are required for this incident, as there is no evidence of compromise.

High: Organizations should maintain vigilance for phishing or social engineering attempts that reference this incident, as threat actors may attempt to exploit public concern.

Medium: Review and monitor access controls for any third-party services or infrastructure associated with open-source projects, ensuring that only authorized contributors have access.

Low: Continue to monitor official communications from the Apache Software Foundation and reputable security news sources for any updates or changes in the incident status.

No specific patches, configuration changes, or workarounds are required for Apache OpenOffice users at this time.

References

BleepingComputer, November 4, 2025: https://www.bleepingcomputer.com/news/security/apache-openoffice-disputes-data-breach-claims-by-ransomware-gang/

Breachsense, October 31, 2025: https://www.breachsense.com/breaches/apache-openoffice-data-breach/

Ransomware.live, Dataset update 2025-11-05: https://www.ransomware.live/id/QXBhY2hlIE9wZW5PZmZpY2VAYWtpcmE=

MITRE ATT&CK Group G1024 (Akira): https://attack.mitre.org/groups/G1024/

CISA Advisory AA24-109A: https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-109a

Qualys Blog (Akira TTPs): https://blog.qualys.com/vulnerabilities-threat-research/2024/10/02/threat-brief-understanding-akira-ransomware

About Rescana

Rescana provides a third-party risk management (TPRM) platform that enables organizations to continuously monitor and assess the security posture of their vendors and open-source dependencies. Our platform delivers actionable insights into supply chain risks, threat intelligence, and incident response readiness. For questions about this report or to discuss your organization’s risk management needs, contact us at ops@rescana.com.