Akira Ransomware Gang Targets LeasePLUS: A Closer Look at the Attack

Recent Incident Overview

In a significant cybersecurity breach, LeasePLUS, a novated lease services provider based in Melbourne’s Docklands, has reportedly suffered a ransomware attack attributed to the Akira ransomware group. This attack has raised concerns regarding the potential exposure of sensitive customer information.

Understanding Novated Leasing

LeasePLUS specializes in novated leasing, a financial arrangement that allows employers to salary package the acquisition and operational costs of vehicles. This service is particularly beneficial for government entities, public health organizations, charities, and various rebateable institutions, enabling them to save on income tax and GST.

The Alleged Attack Details

The Akira ransomware group disclosed the attack on their darknet leak site, showcasing LeasePLUS alongside the message of impending data uploads. Notably, the group claimed to have in their possession approximately six gigabytes of corporate documents, including personal files belonging to over 2,300 individuals—comprising both customers and employees.

This data may contain non-disclosure agreements, contracts, and other sensitive documents that could pose a considerable risk if leaked.

The Ransomware Gang’s Modus Operandi

In a bid to escalate the pressure on their victims, Akira has adopted a somewhat unusual approach in their communications. They issued a statement designed to unsettle affected organizations: “Well, you are here. It means that you’re suffering from a cyber incident right now.” The group characterizes their actions as an uninvited audit aimed at uncovering vulnerabilities within the victim’s network.

Ransom Negotiation Dynamics

While specific ransom demands have not been disclosed, past patterns suggest they can range from $100,000 to upwards of $4 million. Notably, Akira is open to negotiation, with many victims reportedly seeing their initial demands significantly reduced as dialogue progresses. However, the negotiation process can be tough and may involve various hurdles to reach a satisfactory agreement.

Historic Context of Akira Ransomware Gang

First surfacing in March 2023, the Akira ransomware group has quickly come to be recognized as one of the most active threats in the cyber landscape. With a reported total of 874 victims to their name, the group’s tactics and strategies have drawn the attention of cybersecurity experts. Just last month, they targeted another Australian firm, Watkins Steel, signaling their continued focus on Australian businesses.

Response from LeasePLUS

As of now, LeasePLUS has not publicly commented on the situation following the ransomware event. Given the serious implications for their customers and employees, their response—or lack thereof—will be crucial in shaping the narrative surrounding this incident.

Conclusion

The ongoing ramifications of the Akira ransomware attack on LeasePLUS highlight the growing threat of cybercrime. Organizations must remain vigilant and proactive in their cybersecurity measures to protect sensitive data and safeguard against potential breaches.