LeasePLUS Listed by akira Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

People who have used LeasePLUS for novated vehicle leasing, or who work for the company, may now face the practical risk that personal and contractual details have left the organisation’s control. On 18 July 2025 the ransomware group known as akira publicly listed LeasePLUS on its leak site and claimed it had taken internal files. The number of people actually affected remains unknown, yet the claim itself is enough to warrant careful attention from customers and staff alike.

Public detail is limited to the listing and the group’s own statements. No independent confirmation of the full scale or exact contents has been released, so the situation must be treated as an unverified but credible claim of data theft.

Breaking down the breach

According to the reported listing, LeasePLUS was named by the akira ransomware group on 18 July 2025. The group stated that it had exfiltrated internal files during a ransomware attack and was “ready to upload 6 GB of corporate documents.” It further claimed those files included personal files of more than 2 300 people (customers and employees), NDAs, contracts and agreements. No technical details of how the intrusion occurred, when it began, or whether systems were encrypted have been disclosed. The number of people ultimately affected is recorded as unknown; the 2 300 figure is solely the group’s assertion. No official statement from LeasePLUS confirming or denying the claim has been included in the available facts.

The group behind it: akira

Akira is a well-documented ransomware operation that emerged in early 2023 and has since targeted organisations across multiple sectors and countries. Like many modern ransomware groups, it typically employs a double-extortion model: data is first stolen, then systems are encrypted, and the victim is threatened with public release of the stolen material if a ransom is not paid. The group maintains a Tor-based leak site where it posts victim names, sample files and, eventually, larger archives. Its operators have previously claimed attacks against manufacturing, professional-services and financial-adjacent firms, often advertising multi-gigabyte data sets. In this instance the group claims it holds 6 GB of LeasePLUS material and is prepared to publish it; that claim has not been independently verified.

LeasePLUS and its sector

LeasePLUS is described as one of Australia’s leading providers of novated leasing solutions. Novated leasing allows employees to package the cost of a vehicle—purchase, running expenses and related taxes—through their salary, reducing taxable income. Companies in this sector routinely hold customer identity documents, employment and salary details, vehicle contracts, bank-account information for salary packaging, and internal commercial agreements with employers and financiers. Because the service sits at the intersection of personal finance, employment and vehicle ownership, a breach can expose both private individuals and the corporate clients that offer the benefit to their staff. The consequential nature of the data is therefore inherent to the business model rather than any unique feature of this incident.

What was likely exposed

The only data types named in the available facts are “internal files exfiltrated in a ransomware attack.” The group itself claims the haul comprises 6 GB of corporate documents, personal files of more than 2 300 customers and employees, NDAs, contracts and agreements. Beyond that assertion, the exact contents remain unconfirmed. Organisations that administer novated leases typically store names, addresses, dates of birth, tax-file or payroll numbers, vehicle identification details, lease schedules, bank-account data used for salary packaging, and signed commercial contracts. Whether any or all of those categories are present in the claimed 6 GB archive cannot be established from public information. Readers should therefore treat the group’s description as an unverified claim rather than a verified inventory.

Why it matters

For individuals, the practical risks include identity fraud, targeted phishing that references genuine lease or employment details, and the long-term exposure of financial arrangements that were never intended to be public. Contracts and NDAs, if released, could also reveal commercial terms that competitors or other parties might exploit. For LeasePLUS the consequences include regulatory scrutiny under Australian privacy law, potential contractual liability to employer clients, and erosion of trust among the workforce that relies on salary packaging. Because the precise data set is unconfirmed, the full extent of these risks cannot yet be quantified, but the combination of personal and contractual material claimed by the group is sufficient to create lasting concern for anyone whose details were held by the company.

What to do if you're exposed

If you are a current or former LeasePLUS customer or employee, begin by monitoring bank and credit accounts for unexpected activity and consider placing a credit freeze or alert with Australian credit-reporting bodies. Change passwords on any accounts that may have shared credentials or recovery email addresses linked to LeasePLUS communications, and enable multi-factor authentication wherever possible. Be alert to phishing emails or calls that reference vehicle leases, salary packaging or employment details—such messages may now carry greater credibility. Finally, you can run a free exposure scan of your email address to check whether your information has already appeared in known breach data sets; doing so provides an early indication of whether your details are circulating beyond this single incident.

AICompiled with AI assistance from public sources and published under our editorial standards.