Lush Listed by akira Ransomware Group

On January 25, 2024, British cosmetics retailer Lush appeared on the leak site of the Akira ransomware group. The listing states that attackers exfiltrated 110 GB of internal files during a ransomware incident and are preparing to publish them. The company, founded in 1995 and based in Poole, United Kingdom, has not yet issued a public breach notification detailing the exact number of people affected.

Reported Details from the Listing

The Akira leak page explicitly claims that the stolen archive contains personal documents especially passports, along with accounting, finance, tax, project, and client records. It does not specify how many customer or employee records are included, nor does it list every file type. The disclosure indicates the data was taken in a ransomware attack and that 110 GB of material is ready for release. No ransom demand figure or payment deadline is shown on the public page.

Why This Matters for You and Your Family

If you have ever bought from Lush, worked there, or had your details shared with the company as a supplier or partner, your information may now sit in an attacker-controlled archive. Passports and client documents represent high-value identity material that can be used for account takeover, loan fraud, or targeted phishing. Even when a company says it is “handling the matter,” the data already copied by ransomware operators rarely disappears. Ordinary customers and employees are left exposed long after the initial headlines fade.

The Doxxing and Identity-Chain Risk

A single leaked passport or client spreadsheet rarely stays isolated. Attackers and subsequent buyers routinely combine it with credentials from other breaches to build complete identity chains — linking your name, address, date of birth, email, phone number, and reused passwords. These chains fuel doxxing campaigns, SIM-swapping attempts, and harassment that can reach every member of a household. Credential leaks of this nature also cascade into gaming accounts belonging to you or your children, where the same email and password combinations are often reused, turning a corporate breach into persistent personal exposure across platforms.

Akira’s Known Track Record

Public reporting attributes the emergence of Akira to early 2023. The group has since hit organizations across North America, Europe, and Australia, typically listing victims on its dedicated leak site after encryption and data exfiltration. Their playbook usually begins with compromised remote desktop or VPN credentials, followed by lateral movement, data theft, and double-extortion demands. Akira operators have shown willingness to publish sensitive archives when payments are not received, making the Lush listing consistent with their established pattern.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, then use the cleanup of Warden to shrink your exposure footprint.
• Rotate any password you ever used at Lush or similar retail sites and enable 2FA through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next leak that touches your family is caught and acted on in hours, not months.
• Cover the household with DoxxScan family coverage that extends to dependents and children’s gaming accounts, which frequently chain back to the same addresses and credentials exposed in incidents like this.
• Let remediation specialists handle takedown requests across data brokers and extortion sites on your behalf while you focus on securing day-to-day accounts.

The Lush incident is a reminder that retail breaches now routinely expose identity documents once considered safely locked away inside corporate networks. Taking concrete steps today limits how far attackers can travel down the identity chain created by this and future leaks. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that includes children’s gaming accounts at risk from cascading credential abuse.