1. Executive summary
On 2026-11-02 the Akira ransomware group listed Usnext (U.S.NEXT), a web development and IT services provider with more than 800 clients across business, government and non-profit sectors, on its leak site. The listing is an operator claim: Akira states it will upload 945GB of corporate data and describes employee passports, SSNs, phone numbers and addresses, contracts, client and partner information, financials, project specifications and drawings, and NDAs. No victim confirmation, access vector, affected versions or fixed release is stated in public reporting, and no CVE is associated with this item. The risk to EMEA financial services is indirect and rests on supply-chain exposure: a managed-services provider of this profile holds client project data, credentials and system access, and any financial-services client of Usnext should treat its own data as potentially in scope until the claim is verified or refuted. Severity for a financial-services reader is assessed as moderate pending confirmation, because the listing names no financial-sector victim and no source shows a link to financial services.
2. Regulatory framing
| Article | Trigger (the fact in this item) | Practical impact |
|---|---|---|
| DORA Art. 28: ICT third-party risk — general principles | The listed victim is an IT services and web development provider with over 800 clients, so financial entities using it hold a third-party ICT dependency whose exposure is now claimed. | Clients should confirm whether Usnext is a registered ICT third-party provider in their register of information and assess the dependency against the operator's claim. |
| DORA Art. 29: preliminary assessment of ICT concentration risk | A single provider serving more than 800 clients is a concentration point; the claim of 945GB of client and partner data bears on how many clients could be affected at once. | Where Usnext is a provider, the concentration assessment should be revisited with the claim as an input, not treated as unchanged. |
| NIS2 Art. 21(2)(d): supply chain security measures | The incident is a supply-chain exposure at a provider, which is the fact the supply-chain measure addresses. | Entities in NIS2 scope that use Usnext should assess supply-chain security for that relationship and record the outcome. |
3. Technical analysis & attack chain
The only confirmed facts are the leak-site listing itself. Akira posted Usnext as a victim on 2026-11-02 and stated an intent to publish 945GB of corporate data "soon". The listing describes the data categories as detailed employee information (passports, SSNs, phone numbers, addresses), contracts and agreements, client and partner information, financials, project material including specifications and drawings, and NDAs. The listing gives no country, no website and no victim statement.
What the listing does not establish: the initial access vector, the exploited component or CVE, the dwell time, the exfiltration method, whether the data has actually been published, and whether Usnext has confirmed the intrusion. None of these appear in public reporting. No CVE is associated with this item, so there is no CVSS score, EPSS value or CISA KEV state to report. No malware capability, persistence mechanism, command-and-control channel or lateral-movement detail is available for this event.
Attribution to Akira rests on the operator's own leak-site claim, which is the group naming itself. Akira has a MITRE ATT&CK profile (G1024), but that profile describes the group's known tradecraft generally and does not confirm any specific technique was used against Usnext. Treat the attribution as the operator's claim, not an independently verified finding.
The data categories claimed are consistent with a provider that holds client project files and identity documents, which is what a web development and IT services firm of this profile would hold. That is an assessment about the victim's business, not a finding about the intrusion.
4. Mitigation & containment
P1 (within 24h)
- If your organisation uses Usnext for web development, IT management or project work, contact the provider through a known-good channel (not an address taken from the leak site) and ask directly whether the claim is confirmed, what data categories are affected, and whether any of your project or credential material is in scope. Record the answer.
- Identify any credentials, API keys, source repositories, staging or production access, or client data you have shared with Usnext, and rotate or revoke the ones that would matter if exposed. The listing claims client and partner information and project material, so assume shared project artefacts are in scope until told otherwise.
- Check for authentication or access anomalies on any system where Usnext staff or service accounts have or had access, and review recent changes to those systems.
P2 (within 72h)
- If Usnext is a registered ICT third-party provider, update the register entry with the claim and the provider's response, and feed the outcome into the concentration assessment.
- Review contracts with the provider for breach-notification and data-return or deletion terms, and confirm what the provider is obliged to tell you and when.
- Where the provider holds personal data of your employees or customers, prepare for the possibility that identity documents (passports, SSNs) are in the claimed dataset and assess your own notification exposure.
P3 (within 7 days)
- Monitor the leak site for the actual publication of the 945GB and compare any published file listing against your shared project material.
- If the provider confirms a breach affecting your data, run your incident process and assess reporting obligations under the articles engaged in §2.
No fixed release, patch or version number applies: this is a leak-site listing, not a vulnerability, and no vendor fix is named in public reporting.
5. Indicators of compromise
No indicators of compromise available in the source material.
The listing provides no hashes, domains, IP addresses, file paths or other atomic indicators. The only observable is the leak-site entry itself, which is a publication, not a pivotable artefact.
6. Detection
Insufficient indicators to author detection rules.
Threat actor context
Akira · G1024 · aka GOLD SAHARA, PUNK SPIDER, Howling Scorpius
Akira is a ransomware variant and ransomware deployment entity active since at least March 2023. Akira uses compromised credentials to access single-factor external access mechanisms such as VPNs for initial access, then various publicly-available tools and techniques for lateral movement. …
7. Sources
- Ransomware.live, "Ransomware: akira named Usnext", https://www.ransomware.live/id/VXNuZXh0QGFraXJh, 2026-11-02
- Ransomware.live, "Victim: Usnext – akira", https://www.ransomware.live/id/VXNuZXh0QGFraXJh
Both entries are the same leak-site record; the claim is single-sourced and has not been corroborated by the victim or an independent party.
8. Adverse Trace position
Adverse Trace assesses this as a moderate, unconfirmed supply-chain exposure for EMEA financial services: the listing is an operator claim with no victim confirmation, no access vector and no CVE, and it names no financial-sector victim, so it does not support a high severity rating. The material risk is to any financial-services client of Usnext whose project data, credentials or client information sit with the provider, and that risk is real only if the claim is confirmed. We will monitor the leak site for the stated 945GB publication, re-check the listing for a victim statement or country detail, and update this advisory if Usnext confirms the intrusion or if published data is shown to include financial-services client material. Clients using Usnext should treat the P1 credential and access review as the immediate action and report back what the provider tells them.
Published via PulseTrace — Adverse Trace threat intelligence.