Soapy Joe's Car Wash listed on Akira ransomware leak site

• Ransomware group: Akira
• Country: United States
• Sector: Retail & E-Commerce
• Announcement date: November 7, 2025

Akira ransomware group claims breach of Soapy Joe's Car Wash

The Akira ransomware group has listed Soapy Joe's Car Wash on its dedicated leak site, claiming to have successfully executed a data breach against the organization. According to the announcement made on November 7, 2025, the threat actors allege they have accessed and compromised a significant volume of corporate information. The group claims that the total amount of data obtained exceeds 40 GB, though no specific file count was provided in the announcement.

The breach, which the attackers claim occurred around October 5, 2025, involves the alleged theft of sensitive documents. While the group has not provided any screenshots to validate their claims, the announcement suggests that the stolen files contain highly sensitive information pertaining to the company's internal operations and its workforce. This type of activity is characteristic of modern ransomware operations that focus on data exfiltration to increase their leverage during negotiations.

Details of the alleged data theft

The information allegedly stolen by the Akira group is extensive and covers various categories of sensitive data. The threat actors claim to have obtained a wide array of documents that could pose significant risks to the individuals involved and the company itself. The alleged data includes personal employee information, such as phone numbers and addresses, as well as highly sensitive identification documents like driver's licenses and passports.

Furthermore, the claim specifies that the stolen data includes approximately 2000 Social Security Numbers (SSN). In addition to these identifiers, the leaked information reportedly contains medical information, detailed financial records, various contracts, and non-disclosure agreements. The breadth of this data suggests a deep penetration into the organization's digital environment.

The list of allegedly compromised data includes:

• Employee personal data
• Driver's licenses
• Passport information
• Social Security Numbers (SSN)
• Medical information
• Financial records
• Contracts and non-disclosure agreements

About Soapy Joe's Car Wash

Soapy Joe's Car Wash is a car wash service provider based in San Diego. The company has been voted the best car wash in the region and holds a Guinness World Record.

Impact and broader implications of the attack

The alleged exposure of such a diverse set of data carries heavy implications for both the organization and its employees. The theft of personal identifiers, such as Social Security Numbers, passports, and driver's licenses, significantly increases the risk of identity theft for the affected staff. Furthermore, the availability of contact details and financial records makes employees potential targets for highly specific and targeted phishing attacks, often referred to as spear-phishing.

From a regulatory perspective, the organization may face significant legal challenges. Depending on the specific circumstances and the nature of the data, the company may have to fulfill data breach notification obligations under various United States state laws and federal regulations. The exposure of operational and financial data also presents substantial risks to the company's reputation and could potentially introduce risks within the broader supply chain.

The Akira group is identified as a Ransomware-as-a-Service (RaaS) operation. Such groups typically employ double extortion tactics, where they not only encrypt an organization's systems but also threaten to leak sensitive data to pressure the victim into paying a ransom. Akira is known to frequently gain initial access to networks through compromised VPN accounts. This highlights a common vulnerability in modern remote-access infrastructures. To defend against such threats, organizations in the retail and service sectors often prioritize implementing multi-factor authentication, maintaining rigorous patch management for VPN gateways, and conducting regular security awareness training to mitigate the risk of credential compromise.