Perpetual Group Listed by akira Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

For customers, clients and counterparties of Perpetual Group, the practical question is straightforward: whether internal files taken in a claimed ransomware incident could expose business or personal details that affect financial privacy, identity security or commercial relationships. Public reporting places the listing on 21 June 2023; the number of people affected remains unknown, and independent confirmation of the full scope is limited.

What is known so far rests largely on a claim by the ransomware group akira that it exfiltrated internal material. Until the organisation or regulators publish a fuller account, people who have dealt with Perpetual Group have reason to treat the episode as a live risk rather than a closed historical note.

Inside the incident

According to the available record, Perpetual Group was listed by the akira ransomware group on or about 21 June 2023. The listing describes a ransomware attack in which internal files were allegedly exfiltrated. The group claims the volume involved totalled 700GB of databases containing highly detailed business information, and states that information about Australians the firm has served would be made available. No independent public confirmation of those figures or of the precise method of intrusion has been supplied in the facts at hand. The number of individuals affected is recorded as unknown. Timing beyond the reported listing date, technical entry path, and any ransom demand or negotiation details are undisclosed.

In short, the incident is publicly visible principally through the threat actor’s leak-site claim. That claim should be treated as an unverified assertion until corroborated by the organisation, law enforcement or regulators.

Who is akira?

Akira is a ransomware operation that emerged in public reporting in 2023 and has been associated with double-extortion tactics: encrypting systems while also copying data and threatening to publish it if payment is not made. The group typically maintains a leak site on which it names victims and, in some cases, posts samples or larger archives. Like other contemporary ransomware crews, it has targeted organisations across multiple sectors and geographies, often focusing on entities whose data or operational disruption carries leverage. Public technical write-ups have described affiliates using common initial-access routes such as compromised credentials or vulnerable remote services, though the specific vector in any single case is not always disclosed.

For this incident, the only actor-specific statements in the record are those attached to the listing itself—the claim of exfiltration, the asserted 700GB volume, and the stated intention to release material concerning Australians served by the firm. No further quotes or demands unique to Perpetual Group are provided in the facts.

Who is Perpetual Group?

Perpetual Group is described in the available summary as a diversified financial services company that has served Australians since 1886, when it was established as a trustee company by a group of businessmen. Organisations of this type commonly provide trustee services, investment management, wealth advice and related fiduciary functions. They routinely hold or process sensitive commercial records, client identity and contact data, account and transaction information, and internal business documentation.

A breach affecting such a firm is consequential because trust and confidentiality sit at the centre of the relationship with clients and counterparties. Even when the exact contents of stolen files remain unconfirmed, the sector’s data profile means that exposure can touch both individual privacy and the integrity of commercial arrangements.

What data was at risk

The facts name the exposed material as internal files exfiltrated in a ransomware attack. The akira listing further claims 700GB of databases with highly detailed business information and indicates that information about Australians the group served would be published. Exact data types beyond that description—such as specific categories of personal identifiers, account numbers or documents—are not itemised in the public record supplied here. The number of people affected is unknown.

Financial-services and trustee organisations typically hold client names and contact details, identification documents, account and portfolio data, beneficiary information, internal correspondence and commercial contracts. Whether any or all of those categories were present in the claimed 700GB archive is unconfirmed. Readers should treat the actor’s description as a claim, not as a verified inventory.

What's at stake

For individuals and businesses connected to Perpetual Group, the concrete risks are those that follow from unauthorised access to financial-sector internal files: possible misuse of personal or commercial details for fraud, social engineering, or competitive harm; lingering uncertainty while the full contents remain unverified; and the administrative burden of monitoring accounts and correcting any downstream misuse. For the organisation, stakes include regulatory scrutiny, client notification duties, reputational damage and the cost of investigation and remediation. Because the scale of affected people is unknown and the precise file contents are not independently detailed in the facts, the outer bound of harm cannot yet be stated with precision.

• Potential exposure of business and client-related records claimed by the threat actor
• Unknown number of individuals who may need to monitor for fraud or phishing
• Operational and regulatory follow-on costs for the firm
• Continued uncertainty until official confirmation or fuller disclosure appears

What to do if you're exposed

If you are a current or former client, counterparty or employee of Perpetual Group, begin with basic hygiene: treat unexpected messages that reference the firm or your accounts with caution; enable multi-factor authentication on email and financial logins where available; and watch statements for unfamiliar activity. Consider placing fraud alerts or credit monitoring if you believe sensitive identity data may have been involved, and retain any official notices the company issues. Because public detail on exact victims remains limited, a practical next step is to check whether your email address has already appeared in known breach datasets via a free exposure scan, then act on any confirmed hits by changing passwords and reviewing linked accounts.

AICompiled with AI assistance from public sources and published under our editorial standards.