> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # Ransomware: akira named Manders (GB) - URL: https://f4n6.co.uk/security-feed/ransomware-akira-named-manders-gb/ - Published: 2026-09-16T20:45:59.000Z - Updated: 2026-09-16T20:45:59.000Z - Author: Jeff Davies - Tags: #security-feed, akira ## 1\. Executive summary On 2026-09-16 the Akira ransomware group published a victim entry for "Manders" (country listed as GB) on its leak site, claiming it will upload 70GB of corporate data comprising employee PII (SSN numbers, passports, driver's licences), financials, confidential client files, contracts and NDAs. The source contains no intrusion vector, exploited component, malware detail, or infrastructure — no CVE is referenced, so no CVSS score, severity rating, or CISA KEV exploitation state applies to this item. The claim is single-sourced (a leak-site index entry) and has not been verified by the victim; the listing describes data theft and extortion only, with no encryption or ransomware deployment described. For most EMEA financial services clients this is a third-party/vendor-exposure item rather than a direct incident — the bottom-line risk is contingent on whether Manders sits in your vendor, contractor, or counterparty estate, and on whether any of your own data was shared with it. Attribution to Akira is consistent with the existence of a MITRE ATT&CK profile for the group (G1024), but the underlying intrusion claim itself remains unconfirmed. ## 2\. Regulatory framing No specific DORA/NIS2 article is directly engaged by this item. The item is a leak-site claim about a third party with no confirmed nexus to any financial entity, no confirmed ICT third-party relationship (the victim is described as a maintenance, renovation and painting contractor — not an ICT service provider), and no confirmed incident at a client. DORA Art. 17–19 are triggered by an ICT-related incident *at the financial entity*; DORA Art. 28–30 by an *ICT* third-party relationship; NIS2 Art. 21(2)(d) and Art. 23 by supply-chain and incident-reporting duties of an in-scope entity. None of those trigger facts are established by this source. Clients should treat the item as vendor-exposure intelligence and apply their own incident-classification process if, and only if, a relationship with Manders is confirmed. ## 3\. Technical analysis & attack chain ### Confirmed steps (from the source only) 1. On or before 2026-09-16, an operator using the group name "akira" published a victim entry for "Manders", country GB, on the Akira leak site. 2. The entry states the operator "will upload 70gb of corporate data soon" — i.e. at the time of writing the data had been *claimed*, not yet published. 3. The claimed data categories are: employee personal information (SSN numbers, passports, driver's licences), financials, confidential client files, contracts and agreements, and NDAs. 4. The entry carries a corporate description of "Manders Companies" — a family-owned contractor providing maintenance, renovation support and painting services for multi-family, commercial and residential properties. **What the source does not contain.** There is no initial access vector, no exploited component or CVE, no vulnerability mechanism, no payload or malware capability, no persistence mechanism, no privilege escalation, no command-and-control, no lateral movement, no exfiltration method, and no observed impact beyond the operator's own claim. No encryption or ransomware deployment is described — the listing is a data-theft and extortion claim. Any technical narrative beyond the four steps above would be inference, not reporting. **Discrepancy to note.** The listing records the victim country as GB, while the accompanying corporate description places Manders Companies in the Washington Metropolitan Area (US). Both cannot be assumed correct; the geographic attribution of the victim is unresolved in the source. The description text reads as the victim's own corporate boilerplate, which is consistent with operator-scraped content, but the source does not state how it was obtained. **Attribution — caveated.** The group name "akira" maps to a MITRE ATT&CK profile (G1024), so the actor label is a known tracked group. However, the *claim of compromise* rests entirely on the operator's own leak-site post, indexed by ransomware.live — a single source, unverified by Manders, with no independent corroboration in the material provided. Treat the intrusion as alleged, not confirmed. Do not treat the leak-site entry as evidence that data was in fact exfiltrated or that any specific data category is genuine. ## 4\. Mitigation & containment ### P1 — within 24 hours - Determine exposure: search vendor, procurement, contractor and counterparty registers for "Manders" / "Manders Companies". If there is no relationship, no further action is required beyond monitoring. - If a relationship exists, contact the vendor through a known-good channel (not contact details taken from the leak-site post) to request confirmation of the claim and of any data shared with them. - Stand up monitoring for publication of the claimed 70GB dump on the Akira leak site and on ransomware.live's index for the "Manders" entry. The source states the upload is pending, so the exposure window is open. - Alert fraud, insider-risk and social-engineering defences: the claimed data set (SSN numbers, passports, driver's licences, contracts, NDAs) is directly usable for identity fraud and for pretexting against any organisation that shared personnel or client data with Manders. ### P2 — within 72 hours - If a relationship is confirmed, review the contract for breach-notification, data-protection and confidentiality obligations, and record the notification timeline the vendor owes you. - Identify which of your own data, systems, credentials or physical-site access was shared with Manders personnel, and scope what a leak of that data would expose. - Brief staff who could be impersonated or targeted using leaked contract/NDA detail (procurement, legal, finance, account management). ### P3 — within 7 days - Retrospective review of any access granted to Manders personnel — network accounts, remote access, badge/site access, shared document repositories — and revoke anything no longer required. - If the dump is published, re-assess against your own data holdings and escalate through your incident-management process at that point. No vendor fix, patch, version pin or configuration change is available for this item: the source identifies no vulnerable product or component. ## 5\. Indicators of compromise No indicators of compromise available in the source material. The source contains no hashes, domains, IP addresses, URLs, file paths, registry keys, mutexes or command-line artefacts. The only observable is the leak-site listing itself. ### Behavioural indicators | behaviour | where to observe | confidence | | ---------------------------------------------------------------------------------------- | -------------------------------------------------------- | ----------------------------------------------------- | | Publication of a claimed 70GB data dump under the "Manders" entry on the Akira leak site | Akira leak site; ransomware.live index entry for Manders | Single-sourced (operator claim, unverified by victim) | ## 6\. Detection Insufficient indicators to author detection rules. The only strings present in the source are the actor name ("akira") and the victim name ("Manders"). These are reporting labels, not artefacts of the threat, and a rule built on them would detect coverage of this incident rather than the intrusion itself. No file names, paths, registry keys, command-line flags, mutexes, ransom-note text or hard-coded values are provided. ## Threat actor context **Akira** · [G1024](https://attack.mitre.org/groups/G1024?ref=f4n6.co.uk) · aka GOLD SAHARA, PUNK SPIDER, Howling Scorpius [Akira](https://attack.mitre.org/groups/G1024?ref=f4n6.co.uk) is a ransomware variant and ransomware deployment entity active since at least March 2023\. [Akira](https://attack.mitre.org/groups/G1024?ref=f4n6.co.uk) uses compromised credentials to access single-factor external access mechanisms such as VPNs for initial access, then various publicly-available tools and techniques for lateral movement. … ## 7\. Sources - ransomware.live — "Victim: Manders – akira" — https://www.ransomware.live/id/TWFuZGVyc0Bha2lyYQ== — published 2026-09-16\. (The primary item and the related source supplied for this advisory are the same URL; the claim is therefore single-sourced.) ## 8\. Adverse Trace position We assess this as a **low-to-moderate, contingent** item for EMEA financial services clients. There is no CVE, no CVSS score and no CISA KEV exploitation state to report — the source is a leak-site extortion claim, not a vulnerability disclosure — so severity here is driven entirely by vendor exposure, not by technical exploitability. The claim is single-sourced and unverified by the victim; the victim's geographic attribution is internally inconsistent (GB in the listing, Washington Metropolitan Area in the description); and no technical detail on the intrusion exists in the material. Attribution to Akira is supported only to the extent that a MITRE ATT&CK profile for the group exists (G1024) — the compromise itself is unconfirmed. Clients with no relationship to Manders should take no action beyond noting the item; clients with a relationship should treat it as a potential third-party data-exposure event and work P1 above. We will monitor for publication of the claimed dump and for any victim confirmation, and will re-issue if a client nexus or corroborating technical detail emerges. --- [Read the original source →](https://www.ransomware.live/id/TWFuZGVyc0Bha2lyYQ==?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*