[ Ransomware claim · akira · 2 Nov 2026 ]
Usnext
The ransomware group akira named Usnext on its leak site on 2 Nov 2026. This is the group's own claim: it has not been verified by Cyfenced or Ransomware.live, and some claims turn out to be exaggerated, recycled or false.
[ Status ]Has the attack been confirmed?
The press has reported a cyberattack on Usnext. The organisation's own statement is the best guide to what happened.
- dysruptionhub.com
[ Impact ]Who could be affected
Customers, employees and partners can be affected: services can be interrupted, and personal or business data the organisation holds can be threatened with publication.
[ The attacker ]About akira
akira has claimed 36 organisations in the last 30 days, most in United States, Germany and Switzerland, and mostly in manufacturing, retail & e-commerce and professional services. We wrote about the group in Fifty victims in a day, two hosting breaches and town halls offline.
Other organisations akira has named
- Switzerland
- South Korea
[ What to do ]If you are a customer, partner or neighbour
- Be wary of emails, calls and texts that mention the organisation, especially ones asking you to pay, log in or open an attachment. Criminals use leak-site claims to make phishing believable.
- Check announcements on the organisation's own website or official channels, not on social media reposts.
- If you share accounts or systems with the organisation, change those passwords and check for unusual logins.
- Never visit leak sites or download files claimed to come from the attack: they can contain malware, and handling stolen personal data can be illegal.