Akira ransomware has named Romanian IT supplier System Plus as an alleged victim. The group claims to hold 30 GB of corporate and client data, but the listing remains unverified as of 5 November 2026.
No breach confirmation, leaked files or case-specific technical evidence has been published. The development should therefore be treated as a credible threat actor claim, not proof that System Plus has suffered a confirmed compromise.
Akira ransomware claim against System Plus
The claim appeared in a post on Akira’s Tor-based leak site naming System Plus. RedPacketSecurity’s automated summary attributes the listing to 4 November 2026, while the earliest independently confirmed public reporting and indexing occurred on 5 November 2026.
The listing appears to refer to System Plus SRL, an IT equipment and infrastructure supplier based in Bucharest, Romania. This identification is supported by the description in the Akira post, which matches information published by the company about its business and customers.
System Plus describes itself as a supplier of equipment and IT solutions to large enterprises and Romanian subsidiaries of multinational organisations. Its materials identify HP, HPE and Dell among the technology brands it supplies. The business has operated since the early 1990s.
According to the Akira ransomware listing, the attackers intend to publish 30 GB of information allegedly taken from the company. The categories named in public summaries include:
- Corporate documents and internal business information
- Employee and personal information
- Contracts, agreements and non-disclosure agreements
- Client information
- Project materials
The post reportedly says the material will be released soon. However, no ransom demand or payment figure was included in the available summaries. The post also contained no screenshots or other images that could substantiate the alleged theft.
There is no public confirmation that System Plus systems were encrypted. It is also unclear when any intrusion might have started, how access was allegedly obtained, how long attackers may have remained in the environment or whether business operations were disrupted.
Timeline of the System Plus ransomware listing
4 November 2026
RedPacketSecurity’s automated scrape attributes the Akira leak site post to this date. The summary records the claim that 30 GB of corporate and client information would be published. This is an account of the threat actor’s allegation and does not independently verify a breach.
5 November 2026
Undercode News reported that Akira had listed System Plus and marked the status as unverified. Multiple leak site monitoring services, including ThreatCluster, CTIWatch and CYBERCRIME.works, also indexed an entry using the System Plus name.
These additional sightings confirm that a listing appeared on Akira’s site. They do not establish that the attackers accessed the company’s network or obtained the data they described, because leak trackers generally reproduce or index claims made by threat actors.
Status as of 5 November 2026
System Plus had not published a breach notice or other confirmation on its public websites. No data dump specific to the company had been identified on the open trackers reviewed, and no independent sample of the alleged information was available for examination.
The current exploitation status is therefore claim only. Recent industry reporting has also highlighted the risk of fabricated victim entries appearing on criminal leak sites, making corroboration particularly important before treating such posts as confirmed incidents.
No affected products or versions identified
The System Plus claim is not linked to a disclosed software vulnerability, affected product or specific version. Public reporting concerns alleged access to the organisation’s environment and the possible theft of business data.
No evidence connects the claim to HP, HPE or Dell products supplied by System Plus. Their presence in the company’s portfolio identifies its commercial role, not a weakness in those vendors’ technologies. Customers should not interpret the Akira ransomware post as evidence that any particular hardware or software product has been compromised.
No incident-specific indicators of compromise have been published. There are no confirmed malicious IP addresses, domains, file hashes, account names, processes or file paths that organisations can reliably associate with this particular listing.
How Akira ransomware attacks usually operate
There are no public technical details showing how Akira allegedly accessed System Plus. Any description of attack methods must therefore be understood as general context about the group, rather than evidence from this event.
Akira is associated with double extortion, in which attackers steal information before encrypting systems and then use the threat of publication to increase pressure on the victim. In this case, data publication is the only element alleged publicly. Encryption has not been confirmed.
A joint CISA, FBI and partner advisory on Akira documents several access methods observed across other incidents. These include exploitation of exposed edge services or VPN appliances, use of stolen credentials where multi-factor authentication is absent, and abuse of legitimate remote access tools.
Once inside a network, Akira operators may attempt to expand their access, collect sensitive information and transfer it outside the victim environment before deploying ransomware. None of these stages has been demonstrated in the System Plus case.
CISA advisory AA24-109A includes general indicators associated with Akira operations, such as file paths, process names and network indicators. These may support broader threat hunting, but they are not specific to System Plus and should not be treated as proof of exposure to this event.
Why the unverified Akira ransomware claim matters
System Plus occupies a potentially sensitive position as an IT supplier serving large organisations and multinational subsidiaries. If the alleged client information is genuine, it could expose contracts, project details, contacts or other material useful for targeted fraud and follow-on intrusion attempts.
The immediate risk, however, is uncertainty. Customers and partners do not yet know whether data was taken, which relationships might be represented, or whether any third-party access was affected. Public speculation should not replace direct communication and evidence-led investigation.
Actions for organisations with relevant supplier links
Organisations that have a current or previous relationship with System Plus should review the specific connections involved without assuming a breach has occurred. Priority steps include:
- Check for unusual activity involving supplier accounts, remote support tools and privileged connections.
- Confirm that third-party access is limited to required systems and protected by multi-factor authentication.
- Ask the supplier through established contacts whether any notification or precautionary action is required.
- Review contracts for incident reporting obligations and processes for responding to possible client data exposure.
- Monitor for convincing phishing messages that reference genuine projects, contracts or supplier relationships.
More broadly, organisations can apply the mitigations in the joint Akira advisory, including hardening remote access, patching internet-facing devices, segmenting networks and maintaining resilient backups. These controls address known Akira ransomware tradecraft, although they do not confirm or disprove the System Plus allegation.
Originally reported by redpacketsecurity.com.
