Leo International Data Breach

Leo International has been identified as a victim on the Akira ransomware group’s dark web portal, with the listing published on June 23, 2026. This information was uncovered by SOCRadar’s Dark Web Monitoring service. The specific country or industry sector for Leo International was not provided in the listing, making direct geographical or industrial attribution impossible. Its inclusion adds to Akira’s continuous stream of claimed victims, indicating a prolific ransomware operation.

SOCRadar’s analysis of stealer logs did not reveal any evidence of credential exposure related to leointernational.com in the sampled data. However, this absence does not confirm a lack of compromise. Credentials could have been harvested using alternative corporate domains, personal email addresses not covered in the dataset, or appeared in feeds indexed after the sample was taken. Given the unconfirmed nature of Leo International’s own domain and location data in the listing, the possibility of credential exposure through other channels remains significant. Ransomware groups like Akira commonly exploit infostealer-harvested credentials for initial access, using them to gain entry into systems via Microsoft 365, VPNs, or remote access portals before deploying ransomware. CTI teams are advised to maintain vigilance through continuous monitoring and proactive credential hygiene measures.