Lush Listed by akira Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to pressure organisations by stealing data and threatening public release, a pattern that has become a routine feature of the current cyber-threat landscape. In late January 2024, the cosmetics retailer Lush appeared on a leak site operated by the group known as akira, which claimed to have taken internal files during a ransomware attack.

Public detail remains limited: the number of people affected is unknown, and independent confirmation of the full scope has not been published. What is known comes largely from the group’s own listing, which asserts that roughly 110 GB of material was prepared for release and that the archives contain personal documents, including passports, along with accounting, finance, tax, project and client information. For customers, employees and partners, any such claim warrants careful attention even while verification is incomplete.

Breaking down the breach

On 25 January 2024 it was reported that Lush had been listed by the akira ransomware group. According to the group’s statement, internal files were exfiltrated in a ransomware attack and 110 GB of those files were prepared for uploading. The listing specifically mentions personal documents, especially passports, as well as accounting, finance, tax, projects, clients information and “much more.” No independent confirmation of the intrusion method, the exact date of compromise, or the total number of individuals affected has been made public. The scale of any confirmed exposure therefore remains undisclosed beyond the group’s claim of 110 GB of material.

Inside akira

Akira is a ransomware operation that has been active since early 2023 and is known for double-extortion tactics: encrypting systems while also stealing data and threatening to publish it if a ransom is not paid. The group typically posts victim names and sample file lists on a dedicated leak site, a practice intended to increase pressure. Public reporting has linked akira to attacks across multiple sectors, including manufacturing, professional services and retail, often using compromised credentials or unpatched remote-access services as initial entry points. In this case the group claims Lush’s data is among the material it holds; that claim has not been independently verified in the available reporting.

Who is Lush?

Lush is a cosmetics retailer founded in 1995 and headquartered in Poole, United Kingdom. The company specialises in handmade bath bombs, hair products, makeup and related personal-care items sold through its own stores and online channels. Like most retailers of this size, it routinely processes customer orders, loyalty or account data, employee records, supplier contracts and financial documentation. A breach involving internal files therefore carries potential consequences for both the commercial operation and the individuals whose personal or financial details may appear in those files. Because the company operates internationally, any confirmed exposure could affect people in multiple jurisdictions.

The information in question

The only data types named in the available facts are “internal files exfiltrated in a ransomware attack.” The akira listing further claims that the 110 GB archive includes personal documents, especially passports, together with accounting, finance, tax, project and client information. Exact contents have not been independently confirmed, and the number of people whose records may be present remains unknown. Organisations of Lush’s type typically hold customer contact and purchase histories, employee identity and payroll data, supplier contracts and tax filings; whether any of those categories appear in the claimed archive is unconfirmed beyond the group’s statement.

The real-world impact

If the claimed files contain genuine personal documents such as passports, affected individuals face elevated risks of identity fraud, account takeover or targeted phishing. Financial and tax records could be used to craft convincing social-engineering attempts against the company or its partners. For Lush itself, the incident may disrupt operations, require forensic investigation and notification obligations, and damage customer trust. Because the number of people affected is unknown and the precise contents unconfirmed, the practical impact cannot yet be quantified; the primary risk remains the potential misuse of any personal or financial data that may have been taken.

What to do if you're exposed

Anyone who has shopped with, worked for or supplied Lush should treat the claim seriously until more detail emerges. Monitor bank and credit accounts for unusual activity, enable multi-factor authentication on email and financial services, and be alert to unexpected messages that reference Lush or request personal information. Consider placing a fraud alert with credit-reference agencies if you believe passport or identity documents may be involved. Readers can also run a free exposure scan of their email address to check whether that address has already appeared in known breach data sets; such a check provides an early indication of wider exposure and can guide further protective steps.

AICompiled with AI assistance from public sources and published under our editorial standards.