Mahindra Racing Listed by akira Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to target organisations of every size and sector, using data theft and the threat of public release as leverage. Against that backdrop, Mahindra Racing was listed by the Akira ransomware group on or around 4 June 2024. Public reporting indicates the group claims to have exfiltrated internal files and intends to release a substantial volume of data. The number of people affected remains unknown, and independent confirmation of the full scope is limited. For a motorsport team that holds personal, financial and technical information, any such claim raises concrete questions about exposure and next steps.

What follows is a factual account drawn only from the available breach record and well-established public knowledge of the actor and sector. Where details are undisclosed, that limitation is stated plainly.

Breaking down the breach

According to the breach record, Mahindra Racing was listed by the Akira ransomware group with a reported date of 4 June 2024. The record characterises the incident as a ransomware attack in which internal files were allegedly exfiltrated. The group’s own listing claims that 114 GB of data will be released soon and asserts possession of information on pilots and other employees (including passports and related documents), financial statements, accounting material, NDAs, and technical details such as car setups. No independent verification of the volume, the precise contents, or the method of intrusion has been supplied in the public record. The number of individuals affected is listed as unknown. Timing of the initial compromise, any encryption of systems, ransom demands, or subsequent negotiations are not disclosed.

In short, the publicly available facts establish only that the organisation appeared on Akira’s leak site with the above claims attached. Everything beyond that listing remains unconfirmed.

The group behind it: akira

Akira is a ransomware operation that has been active since early 2023 and is widely documented for double-extortion tactics: operators exfiltrate data before or during encryption and then threaten to publish it on a dedicated leak site if payment is not made. The group has historically targeted a range of sectors, including manufacturing, professional services and technology, often using phishing, compromised credentials or known vulnerabilities to gain initial access. Once inside, Akira affiliates typically move laterally, harvest credentials and stage large data transfers before deploying ransomware. Victims are then listed on the group’s dark-web site with sample files or volume claims intended to increase pressure. These operational patterns are drawn from extensive public reporting on the actor; they do not constitute proof of the exact techniques used against Mahindra Racing. In this case, the listing itself is treated as an unverified claim by the group.

About Mahindra Racing

Mahindra Racing is one of the founding teams of the FIA Formula E Championship, the world’s first all-electric street-racing series. As a professional motorsport organisation it operates race cars, employs drivers (pilots), engineers, logistics staff and support personnel, and maintains commercial relationships with sponsors, suppliers and the Mahindra Group. Organisations of this type routinely hold employee and contractor personal data, travel and identity documents, financial and accounting records, contractual material such as NDAs, and sensitive technical information including vehicle setups and performance data. A breach claim against such an entity is consequential because the data set can combine personal identifiers of individuals with commercially sensitive intellectual property and financial records, creating both privacy and competitive risks.

What was likely exposed

The breach record names the exposed material as “internal files exfiltrated in ransomware attack.” The group’s listing further claims possession of information on pilots and other employees (passports and other documents), financial statements, accounting records, NDAs, and technical data such as car setups, with a stated volume of 114 GB to be released. These assertions come solely from the threat actor and have not been independently verified in the public record. Exact file inventories, the proportion of personal versus technical data, and whether any data has actually been published remain unconfirmed. Organisations in motorsport and high-performance engineering typically store precisely the categories listed—identity documents for travel, payroll and accounting files, contracts, and proprietary vehicle data—so the claimed contents are consistent with what such a team would hold. That consistency does not prove the claim; it simply indicates the categories that would be of concern if the listing is accurate.

Why it matters

If the claimed data set is genuine, individuals whose passports, personal details or employment records appear in the material face risks of identity theft, targeted phishing or travel-document fraud. Financial and accounting files could expose banking relationships, invoices or salary information, increasing the chance of fraud against the organisation or its partners. NDAs and commercial contracts, if released, may reveal confidential terms with sponsors or suppliers. Technical data such as car setups, while less immediately useful for identity crime, can carry competitive and intellectual-property value. For the organisation itself, the incident creates operational, reputational and regulatory considerations: potential notification duties, customer and partner inquiries, and the need to assess whether systems remain compromised. Because the number of affected people is unknown and the precise contents unconfirmed, the scale of individual harm cannot yet be quantified; the risk is real but bounded by the limits of public information.

Were you affected?

If you are a current or former driver, employee, contractor or close partner of Mahindra Racing, treat the listing as a prompt for caution rather than confirmed exposure. Monitor bank and credit accounts for unusual activity, be alert to phishing messages that reference racing, employment or travel, and consider placing fraud alerts with relevant credit agencies if you have reason to believe identity documents were involved. Change passwords on any accounts that may have been reused in a work context, and enable multi-factor authentication where available. Because the exact data set remains unverified, these steps are precautionary. Readers can also run a free exposure scan of their email address to check whether that address has already appeared in other known breach data sets; such a scan does not confirm or rule out involvement in this specific incident, but it provides a practical starting point for personal monitoring.

AICompiled with AI assistance from public sources and published under our editorial standards.