On May 14, 2025, the Australian accounting firm MKA Accountants appeared on the leak site of the qilin ransomware group. The firm, based in Moonee Ponds, Victoria, is claimed to have had internal files exfiltrated following a ransomware attack. While the exact number of affected clients remains unknown, anyone whose financial or personal documents were held by the firm may now have their data exposed.
Already exposed?
You can’t unleak data. You can take away what it’s worth.
A leaked record is where it starts, not where it ends. What turns it into your front door is the look-up sites publishing your address beside your name — and those are what an AI reads when somebody asks about you. The free scan shows you both. We write to 580 companies.
See what is exposed about you — free scan →Watch MKA Accountants
Get alerted the next time MKA Accountants files a breach with any US regulator — the filing, dated and sourced. A free single-company slice of Signals; no account needed.
We’ll email you only about MKA Accountants’s future breach filings and how to watch a whole vendor list — not general marketing. Unsubscribe any time.
Watching your whole vendor list (50 to 500 companies, by tier) is GalaxyWarden Signals.
Reported Details of the Incident
Public reporting indicates that qilin operators listed MKA Accountants after exfiltrating internal files. The firm has operated for more than twenty years, providing accounting, tax, and business advisory services to clients across multiple industries. Internal files were taken; no confirmed evidence has surfaced yet showing that client databases, tax returns, or banking details were specifically published. The listing appeared on the qilin leak site, which is tracked by ransomware monitoring services such as ransomware.live. As of the publication of this article, the group had not released samples of the stolen data.
Why This Matters for You and Your Family
If you or your family have used MKA Accountants, your financial history, tax records, addresses, and identification details could be in the stolen material. Accountants hold some of the most sensitive personal data — income statements, bank account numbers, tax file numbers, and sometimes copies of passports or driver’s licences. Once that information reaches a ransomware leak site, it can be downloaded by identity thieves, fraudsters, or harassers within hours. Ordinary families rarely discover the breach until fraudulent loan applications appear or unexpected calls begin. The breach therefore affects everyday people who simply hired a local accountant, not just large corporations.
The Doxxing and Identity-Chain Risks
Stolen accounting files often contain enough personal anchors — email addresses, phone numbers, dates of birth, and physical addresses — to link disparate online handles back to real identities. Criminals can then follow these chains across social media, gaming platforms, and shopping accounts. A credential leak from one service quickly cascades: the same password used for your accountant’s client portal may also protect your email, your child’s Roblox or Fortnite account, and your banking app. Available reporting describes this pattern as an “identity chain” that turns a single breach into repeated targeting, including doxxing, SIM-swapping, and account takeovers. Protecting gaming accounts matters here because children’s usernames and shared family emails frequently appear in the same leaked spreadsheets.