1. Executive summary
On 22 September 2026 the Akira ransomware operation listed the Italian company DI.C.S.EL. S.R.L. on its leak site, claiming to hold 9 GB of corporate data and threatening publication. The claimed data set includes employee personal information (driving licences, EU identity documents), financial records, payment details, projects and NDAs. DI.C.S.EL. is a Milan-headquartered electrical and measurement-sector technical services firm operating in Lombardy; it is not a financial services entity, so direct sector impact is limited to any client, supplier or payment-chain relationships. Akira has a confirmed MITRE ATT&CK profile (G1024) and a multi-year history of extortion-led intrusions against mid-sized European organisations. No technical detail on the intrusion itself, and no indicators, are present in the source material; this advisory reflects a leak-site listing only.
2. Regulatory framing
No specific DORA/NIS2 article is directly engaged by this item. The victim is an Italian electrical and measurement-sector company with no indicated role as a financial entity, ICT third-party provider to financial entities, or NIS2/UK NIS regulated operator. The trigger facts needed to engage DORA Art. 28/29/30 (an ICT third-party relationship with a financial entity) or NIS2 Art. 21(2)(d) (a supply-chain dependency) are absent from the source material. Clients should re-assess if DI.C.S.EL. appears in their supplier register or if Akira publishes the claimed project or NDA material.
3. Technical analysis & attack chain
The only confirmed fact is the leak-site listing itself: Akira named DI.C.S.EL. S.R.L. as a victim on or before 22 September 2026 and stated that 9 GB of corporate data would be uploaded "soon". The claimed data categories are employee identity documents (driving licences, EU IDs), financials, payment details, projects and NDAs. The listing implies data theft for extortion; the source does not state whether encryption of systems occurred, and we do not assert it.
No attack chain can be reconstructed. The source material contains no initial access vector, no exploited vulnerability or CVE, no malware detail, no persistence mechanism, no command-and-control infrastructure, no lateral movement detail and no timeline of the intrusion. Ransomware.live indexes the operators' public post only and does not access the stolen data, so the 9 GB figure and the data-category claims are the attackers' own assertions and are unverified.
Attribution to the Akira operation is supported by the leak-site branding and by the verified MITRE ATT&CK profile (G1024). The specific individuals behind this intrusion are unknown, as is whether the affiliate responsible used Akira-branded encryptor tooling; affiliate-level attribution is unconfirmed.
Confidence caveat: every substantive claim in this section is single-sourced, from the Akira leak-site post as indexed by Ransomware.live. Verify before enforcement.
4. Mitigation & containment
The source gives no victim-side technical detail, so the actions below are exposure checks for Adverse Trace clients rather than containment of a known intrusion.
P1 (within 24h):
- Search supplier, client and payment registers for DI.C.S.EL. S.R.L. and any Milan or Lombardy electrical/measurement entities in the same group. If a relationship exists, treat the claimed data set (payment details, projects, NDAs) as potentially compromised and open an incident record.
- If a relationship exists, notify your fraud and payments teams that payment details and NDAs are among the claimed stolen categories, and apply enhanced verification to any payment-instruction change or new request referencing the victim for the next 90 days.
P2 (within 72h):
- Query identity-theft and fraud monitoring for any employee or counterparty linked to the victim, since EU identity documents are among the claimed stolen items.
- If the victim is in your supply chain, request a written statement from them on the incident and on whether any of your shared data (contracts, payment instructions, project files) is in the claimed 9 GB.
P3 (within 7 days):
- If a supplier relationship is confirmed, record the event in third-party risk files and review the contract's incident-notification and audit clauses at next renewal.
- No patching, blocking or configuration action is indicated: the source names no CVE, no malware and no infrastructure.
5. Indicators of compromise
No indicators of compromise available in the source material. The leak-site post contains no hashes, domains, IP addresses, file paths or other atomic indicators. The victim name and the 9 GB claim are the only data points, and neither is machine-pivotable as an IOC.
6. Detection
Insufficient indicators to author detection rules. The source material contains no strings, command lines, file names, registry keys, mutexes or network artefacts attributable to the intrusion.
Threat actor context
Akira · G1024 · aka GOLD SAHARA, PUNK SPIDER, Howling Scorpius
Akira is a ransomware variant and ransomware deployment entity active since at least March 2023. Akira uses compromised credentials to access single-factor external access mechanisms such as VPNs for initial access, then various publicly-available tools and techniques for lateral movement. …
7. Sources
- Ransomware.live, "Victim: DI.C.S.EL. S.R.L. – akira", https://www.ransomware.live/id/REkuQy5DLkVMLiBTLlIuTC5AYWtpcmE= (accessed 22 September 2026). Note: the base64 segment in the fetched copy of the page URL differs by one character from the primary item's URL; both resolve to the same victim listing on the platform.
8. Adverse Trace position
We assess this as a low-direct-impact, single-sourced extortion listing: a named Italian SME with no indicated financial-services role, claimed data theft of 9 GB including identity documents and payment details, and no technical detail to act on. The risk to our clients runs through supplier and payment relationships, not through a shared technical vulnerability, and we have flagged the attribution as confirmed only at the operation level (Akira, MITRE G1024), not at the affiliate level. We will monitor the Akira leak site for the promised data upload and for any additional Italian or EMEA financial-adjacent listings, and we will reissue this advisory with technical detail and indicators if credible reporting on the intrusion emerges.
Published via PulseTrace — Adverse Trace threat intelligence.