Leiblein & Kollegen Steuerberatungsgesellschaft Listed by losttrust Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

When a tax and accounting firm appears on a ransomware group's leak site, the practical stakes fall first on clients and contacts whose financial and personal records may sit inside the firm's systems. On 26 September 2023, Leiblein & Kollegen Steuerberatungsgesellschaft was listed by the group known as losttrust, which claimed that internal files had been exfiltrated in a ransomware attack. The number of people affected remains unknown, and public detail about exactly what left the network is limited. For anyone who has entrusted tax returns, payroll data, or identity documents to a German Steuerberatungsgesellschaft, the listing is a signal to treat the possibility of exposure seriously until clearer information emerges.

This article sets out only what has been reported, places the claim in context, and outlines concrete steps people can take. It does not assert that the listing has been independently verified or that any particular client's file was among the material the group says it took.

Inside the incident

According to the public record of the listing, Leiblein & Kollegen Steuerberatungsgesellschaft was named by the losttrust ransomware group on or around 26 September 2023. The group claimed that internal files had been exfiltrated in a ransomware attack. No confirmed figure for the number of individuals affected has been published. The precise method of initial access, the duration of any intrusion, whether encryption was also deployed, and whether a ransom was demanded or paid are all undisclosed in the available facts.

What is stated is that the material described as taken consisted of internal files. Beyond that characterisation, the scale of the alleged theft, the file types, and any subsequent publication of sample data are not detailed in the reported summary. Readers should therefore treat the incident as an unverified claim of exfiltration associated with a ransomware operation, not as a fully documented breach with confirmed victim counts or forensic findings.

Who is losttrust?

losttrust is a ransomware operation that has appeared in public reporting as a group that conducts double-extortion attacks: encrypting systems where possible while also copying data and threatening to publish it if payment is not made. Like other actors in this category, the group has maintained a leak site on which it names organisations it claims to have compromised and, in some cases, posts samples or larger archives. Listings on such sites are claims by the criminals themselves; they are not independent confirmations of a breach, nor do they automatically prove that every file the group advertises is authentic or complete.

Public knowledge of losttrust's broader activity does not extend to verified, incident-specific statements about Leiblein & Kollegen beyond the fact of the listing and the assertion that internal files were exfiltrated. No quotes, ransom amounts, or technical indicators unique to this victim are supplied in the facts at hand, and none are invented here.

Who is Leiblein & Kollegen Steuerberatungsgesellschaft?

Leiblein & Kollegen Steuerberatungsgesellschaft mbH is described as an accounting-industry firm headquartered in Aschaffenburg, Bayern, Germany. It is reported to employ between 11 and 20 people and to generate roughly $1 million to $5 million in revenue. In Germany, a Steuerberatungsgesellschaft provides tax advisory and related accounting services. Firms of this type routinely handle client tax filings, financial statements, correspondence with tax authorities, and supporting identity and banking information.

Because the work is regulated and document-heavy, such practices sit at a sensitive intersection of personal, corporate, and fiscal data. A ransomware claim against even a modestly sized practice therefore carries weight for clients who rely on the firm for confidential filings, as well as for the firm's own staff and business partners. The available facts do not describe the firm's security posture or any response it may have made; those matters remain outside the public summary.

What data was at risk

The facts name the exposed material only as "internal files exfiltrated in a ransomware attack." No inventory of specific data types—such as tax returns, identity documents, bank details, or employee records—has been disclosed. Exact contents are therefore unconfirmed.

Organisations in the tax-advisory and accounting sector typically hold, in the ordinary course of business, client names and addresses, tax identification numbers, income and asset information, payroll data, contracts, and internal working papers. They may also retain employee personnel files and correspondence. Whether any of those categories were among the files losttrust claims to have taken cannot be established from the reported information. Until the firm or independent investigators publish a clearer accounting, the prudent assumption is that sensitive professional records could have been involved, without treating any particular category as proven.

Why it matters

For individuals and businesses whose data may have been held by the firm, the real-world risks are concrete even when the precise file list is unknown. Tax and accounting records can enable identity fraud, targeted phishing that references real filings, or attempts to open credit or redirect refunds. Corporate clients may face exposure of financial positions or contractual details that competitors or fraudsters could misuse. Because the number of people affected is unknown, anyone who has been a client or counterpart of the firm in recent years has reason to remain alert rather than assume they were untouched.

For the organisation itself, a public ransomware listing can disrupt operations, trigger regulatory notification duties under European data-protection rules, and erode the trust on which an advisory practice depends. Recovery costs, legal obligations, and reputational harm are typical consequences of such incidents across the sector; none of those outcomes are confirmed here as having already materialised, but they illustrate why the claim is consequential.

None of this establishes negligence on the part of the firm. Ransomware groups target organisations of many sizes and security levels; the listing alone does not prove how the alleged intrusion occurred.

Were you affected?

If you are a current or former client, employee, or business partner of Leiblein & Kollegen Steuerberatungsgesellschaft, treat the September 2023 listing as a prompt to act cautiously. Monitor bank and tax accounts for unexpected activity, be wary of unsolicited messages that reference tax matters or the firm by name, and consider placing fraud alerts with relevant credit or identity services where available in your jurisdiction. If the firm contacts you with official guidance, verify that the communication is genuine before supplying further information.

You can also run a free exposure scan of your email address to check whether your information has already surfaced in known breach data sets. That step does not confirm or rule out involvement in this specific incident, but it can indicate whether your credentials or personal details appear elsewhere and help you prioritise password changes and further monitoring.

AICompiled with AI assistance from public sources and published under our editorial standards.