Leo International listed on Akira ransomware leak site

• Ransomware group: Akira
• Country: United States
• Announcement date: June 23, 2026

Akira ransomware group targets Leo International

The Akira ransomware group has officially listed the American company Leo International on its dedicated leak site. According to the announcement made on June 23, 2026, the threat actors claim to have successfully compromised a significant amount of corporate information. The group has asserted that they intend to publish the stolen data, marking a significant escalation in their pressure against the organization.

The threat actor claims that the breach occurred following an attack that took place on May 13, 2025. While the announcement was made in mid-2026, the group maintains that they gained access to the organization's internal data during the earlier timeframe. The group has stated that approximately 10 GB of corporate data is slated to be uploaded to their platform in the near future.

Claims regarding compromised data types

The Akira group has provided details regarding the nature of the information they claim to have exfiltrated from Leo International. The alleged breach involves a wide array of sensitive materials, ranging from highly personal employee documentation to confidential corporate files. The group has not provided any screenshots to substantiate their claims at this time.

The specific types of data mentioned in the claim include:

• Employee personal documents
• Passports
• Social Security Numbers (SSNs)
• Driver's licenses
• Medical information
• Phone numbers
• Photos
• Addresses
• Confidential internal files

About Leo International

Leo International is an established company that has been operating since 1986. The firm serves as a manufacturer for several critical industrial sectors, specifically the PVF (pipe, valve, and fitting), HVAC, and plumbing industries. Their manufacturing capabilities are specialized, utilizing complex processes such as forging, casting, and injection molding to produce their industrial products.

Potential risks and security implications

This incident presents several significant risks to both the organization and its personnel. The alleged exposure of highly sensitive information, such as Social Security Numbers, passports, and medical data, significantly increases the risk of identity theft for the affected employees. Furthermore, such a breach creates a heightened vulnerability to targeted phishing attacks, where attackers use stolen personal details to craft convincing fraudulent communications.

From a regulatory perspective, the alleged exposure of medical and personal data could lead to serious data privacy violations under various federal regulations and state laws within the United States. The group's use of a double-extortion method—where data is both encrypted and threatened with publication—can severely damage an organization's commercial reputation and disrupt its operational security.

Given the known tendencies of the Akira group to exploit VPN accounts, it is possible that vulnerabilities existed within the organization's network security processes. Additionally, there is a secondary risk that the leaked data could be utilized as a stepping stone for supply chain attacks, potentially impacting the company's broader network of partners and clients. To defend against such threats, organizations typically focus on strengthening network security, implementing multi-factor authentication, and maintaining rigorous monitoring of access points.