Announcement: Skatax Accounting company going to be leaked Listed by ragnarlocker Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On 22 September 2023, Skatax Accounting appeared on the leak site operated by the RagnarLocker ransomware group. The listing announced that the company was “going to be leaked” and stated that internal data had been stolen. Public reporting does not confirm how many people were affected, the precise volume of material taken, or whether any files were subsequently published. What is known is limited to the group’s claim and the characterisation of the material as internal files exfiltrated in a ransomware attack.

For clients, employees and partners of an accounting firm, even an unverified claim of this kind raises practical questions about financial and personal information. The following account sets out only what has been reported, places the claim in the context of the actor involved, and outlines the ordinary risks and steps that follow.

What happened

According to the available record, Skatax Accounting was listed on the RagnarLocker ransomware leak site on or about 22 September 2023. The headline associated with the entry described an announcement that the company was “going to be leaked.” The group claimed to have stolen internal data; the data types named in reporting are internal files exfiltrated in a ransomware attack. No public figure has been given for the number of people affected. Timing of the underlying intrusion, the method of initial access, the scale of any encryption, and whether a ransom demand was paid or files were later released all remain undisclosed in the material provided. The listing itself constitutes a claim by the threat actor rather than an independently verified confirmation of the full scope of the incident.

Inside ragnarlocker

RagnarLocker is a ransomware operation that has been active for several years and is documented in public threat-intelligence reporting for double-extortion tactics. In a typical RagnarLocker intrusion, operators gain access to a victim network, move laterally, exfiltrate data, and then deploy ransomware to encrypt systems. They subsequently threaten to publish the stolen material on a dedicated leak site if payment is not made. The group has historically targeted organisations across multiple sectors, including professional services, manufacturing and other mid-sized enterprises, rather than concentrating exclusively on one industry. Listings on its leak site are used both as pressure on the victim and as public signalling. Nothing in the present record goes beyond the group’s claim that it stole internal data from Skatax Accounting; no additional statements attributed specifically to this victim have been supplied.

About Skatax Accounting

Skatax Accounting is an accounting firm. Organisations of this type routinely handle bookkeeping, tax preparation, payroll support, financial statements and related advisory work for individuals and businesses. In the ordinary course of that work they hold client identifiers, contact details, tax identification numbers, bank and payment information, payroll records, invoices, contracts and internal working papers. Because accounting practices sit at the intersection of personal finance and business operations, a compromise of their systems can affect both the firm itself and the clients whose records it maintains. The consequential nature of a breach claim against such a firm therefore stems less from any unique public profile and more from the sensitivity of the data categories that accounting practices customarily process.

What was likely exposed

The facts name the exposed material only as internal files exfiltrated in a ransomware attack. No further breakdown—by file type, client versus employee records, or volume—has been disclosed. Accounting firms typically retain financial statements, tax returns and supporting schedules, bank details, payroll data, correspondence, and internal administrative documents. It is reasonable to expect that any substantial exfiltration could touch some of those categories, yet the exact contents remain unconfirmed. Readers should treat specific assertions about particular documents or individuals as unverified until corroborated by the organisation or by independent reporting.

Why it matters

If internal files from an accounting practice are taken, the concrete risks include identity theft, tax-related fraud, unauthorised access to bank or payment accounts, and targeted phishing that leverages accurate financial or personal details. Clients may face secondary fraud attempts that appear legitimate because they reference real invoices, tax years or account numbers. Employees whose personnel or payroll information is included could encounter similar misuse. For the firm, the incident can disrupt operations, trigger regulatory notification duties where applicable, and erode client confidence even when the full extent of exposure is still unclear. Because the number of people affected is unknown and the precise data set is undisclosed, the prudent assumption is that anyone who has recently entrusted financial or personal records to the firm should monitor for unusual activity rather than wait for definitive confirmation.

What to do if you're exposed

If you are a client, employee or partner of Skatax Accounting, begin by watching bank, credit-card and tax accounts for unfamiliar transactions or filings. Consider placing fraud alerts or credit freezes with the major credit bureaus if you believe sensitive identifiers may have been involved. Change passwords on any accounts that shared credentials or recovery information with the firm, and enable multi-factor authentication where it is available. Be sceptical of unsolicited messages that reference invoices, refunds or tax matters and that urge immediate action. Retain copies of any formal notice you receive from the organisation. As an additional check, you can run a free exposure scan of your email address to see whether it has already appeared in known breach data sets; that step does not confirm involvement in this specific incident but can indicate whether your address is circulating more widely.

AICompiled with AI assistance from public sources and published under our editorial standards.