1. Executive summary
The Akira ransomware group (MITRE G1024) posted CHAT Insurance, an Ontario-based insurer with 10 offices and more than 20,000 policyholders, to its leak site on 2026-10-28, claiming 112GB of corporate data and threatening publication. The claimed material is employee identity documents (passports, driving licences, birth certificates), client personal information for roughly 250 individuals (licence numbers, names, addresses, phone numbers), contracts, agreements and NDAs. No CVE, CVSS score, EPSS value or CISA KEV entry is associated with this item, and the leak-site post gives no initial-access vector, so the intrusion mechanism is unknown. For EMEA financial services the exposure is third-party and downstream: any client with a reinsurance, broking, claims-handling or delegated-authority relationship to this insurer should treat policyholder and counterparty data shared with it as potentially disclosed. The claim is single-sourced to the actor's own leak-site post and has not been corroborated by the victim or a third party.
2. Regulatory framing
| Article | Trigger (the fact in this item) | Practical impact |
|---|---|---|
| DORA Art. 28 | Akira claims to hold client personal information and contracts belonging to an Ontario insurer, which EMEA clients may use as an ICT third-party or downstream service provider | Clients must establish whether CHAT Insurance sits in their register of ICT third-party arrangements and assess the contract's data-breach and audit clauses before deciding on notification |
| DORA Art. 19 | The claimed dataset includes personal data of individuals that may include EEA policyholders or counterparties handled through a client relationship | If a client confirms EEA data is in scope and the incident meets its major-incident thresholds, the reporting clock to the competent authority starts from classification, not from this post |
| NIS2 Art. 21(2)(d) | The exposure runs through a supply-chain relationship (insurer as provider to the client), not a direct compromise of the client | Clients in NIS2 scope must be able to show supply-chain security measures covering this provider, including incident notification obligations in the contract |
3. Technical analysis & attack chain
The source is a leak-site listing. It confirms the claim and the data categories, not the intrusion. The only confirmed sequence is:
- Akira posted CHAT Insurance to its leak site on 2026-10-28.
- The post states 112GB of corporate data will be uploaded "soon", so publication had not occurred at the time of the listing.
- The post enumerates the claimed contents: employee passports, driving licences, birth certificates and other personal documents; project files containing client personal information for approximately 250 persons (licence numbers, names, addresses, phone numbers); contracts and agreements; NDAs.
Nothing in the source describes initial access, the vulnerability or credential used, the encryptor, exfiltration tooling, command-and-control, or persistence. Akira is a known double-extortion operation and MITRE ATT&CK carries a group profile (G1024), but the source provides no technique-level detail for this victim, so no attack chain beyond the four steps above can be asserted. Analysts should not infer the entry vector from Akira's prior campaigns and apply it here as fact.
The data categories matter more than the mechanism for a financial services reader. Passports, driving licences and birth certificates are full identity kits suitable for account takeover and synthetic identity fraud. The client list of roughly 250 individuals with licence numbers, addresses and phone numbers is a ready-made target set for impersonation and social engineering against the insurer's policyholders and brokers. Contracts and NDAs disclose commercial relationships and counterparties.
Confidence caveat: every claim in this section is single-sourced to the actor's leak-site post. Akira has a history of overstating volume and inflating data categories, and no sample files, file listing or victim confirmation is available. Treat the 112GB figure and the data inventory as unverified until CHAT Insurance or a regulator confirms.
4. Mitigation & containment
P1 within 24h
- Establish whether CHAT Insurance appears in the third-party register as an ICT provider, reinsurer, coverholder, claims administrator or broker, and identify every data flow to it that carries EMEA policyholder or counterparty data.
- If a data flow exists, suspend non-essential data sharing to the insurer until it confirms the scope of any breach, and preserve the contract's breach-notification correspondence.
- Brief the fraud team on the exposed identity-document categories. Expect impersonation attempts using real names, licence numbers and addresses of the roughly 250 listed individuals against brokers, claims lines and payment teams.
P2 within 72h
- Pull the DORA Art. 28 contract terms for this provider and check the data-breach notification window and audit rights. If the contract is silent, record the gap for the next renewal.
- Run retrospective fraud review on any claims, payments or account changes involving CHAT Insurance policyholders over the period the data could have been held.
- Confirm with the insurer, in writing, whether EEA-resident data is in the claimed dataset. This determines whether DORA Art. 19 or NIS2 Art. 23 reporting is engaged.
P3 within 7 days
- Add the insurer to the concentration-risk review under DORA Art. 29 if multiple clients share the same provider.
- Require callback verification on any inbound request that quotes policyholder identity details, and route changes to bank details through a second channel.
No vendor fix, patch or version applies: the source names no vulnerable product.
5. Indicators of compromise
No indicators of compromise available in the source material.
The source provides no hashes, domains, IP addresses, file paths, registry keys or email addresses. The only observable is the leak-site listing itself, which is not a machine-pivotable indicator.
6. Detection
Insufficient indicators to author detection rules.
The source contains no artefacts of the threat itself: no strings, filenames, command lines, mutexes, registry keys or network values. A rule built on the victim name or the actor name would detect reporting about the incident, not the intrusion.
Threat actor context
Akira · G1024 · aka GOLD SAHARA, PUNK SPIDER, Howling Scorpius
Akira is a ransomware variant and ransomware deployment entity active since at least March 2023. Akira uses compromised credentials to access single-factor external access mechanisms such as VPNs for initial access, then various publicly-available tools and techniques for lateral movement. …
7. Sources
- ransomware.live, "Ransomware: akira named Insurance Services", https://www.ransomware.live/id/SW5zdXJhbmNlIFNlcnZpY2VzQGFraXJh, published 2026-10-28.
8. Adverse Trace position
Adverse Trace assesses this as a data-exposure and third-party risk item, not a technical vulnerability: no CVE, CVSS score, EPSS value or CISA KEV entry applies, and the intrusion mechanism is unknown. The impact on EMEA financial services clients is indirect and depends on whether they hold a provider or counterparty relationship with CHAT Insurance; where they do, the exposed identity documents and client list create impersonation and fraud exposure that outlasts the leak-site post. The claim is single-sourced to Akira's own listing and unverified; we will monitor for publication of the 112GB archive, for any victim or regulator confirmation, and for Akira TTP reporting that would let us attribute the intrusion method, and we will reissue this advisory if either changes the assessment.
Published via PulseTrace — Adverse Trace threat intelligence.