// THREAT ACTOR
ANUBIS_
DormantANUBIS is a ransomware operator tracked through its public data-leak infrastructure. The group operates under the double-extortion model that defines the modern ransomware ecosystem — file encryption combined with the threat of stolen-data publication on a public leak site — and continues to post fresh victim claims as part of an ongoing extortion campaign.
For Ransomnews editorial coverage of ANUBIS — incident write-ups, attribution notes, and additional context — see the Threat Groups archive or run a site search.
Victims by year
- 2026 64
- 2025 42
Leak site mirrors
2 mirrors tracked, 0 currently reachable. These are criminal-infrastructure URLs — links are deliberately not provided.
-
om6q4a6cyipxvt7ioudxt24cw4oqu4yodmqzl25mqd2hgllymrgu4aqd.onionAnubis blog snapshot · 2026-08-15 01:23 -
anubisyfkh5rixydjpoo3jqucauajz2juybrbtuglcppjj2y3eg3y6ad.onionAnubis blog snapshot · 2026-08-19 21:25
Recent victims
The 50 most recent victims claimed by ANUBIS. Total in the index: 106.
| Date listed | Victim | Description |
|---|---|---|
| 2026-08-18 | Scholle IPN / SIG | Data breach at a global leader in packaging manufacturing. |
| 2026-08-15 | Interim HealthCare | Home Healthcare Agency & Medical Staffing. |
| 2026-08-11 | Cleaver-Brooks | Major data breach at a leading industrial manufacturer. |
| 2026-08-03 | Winn-Dixie | Inside a multibillion-dollar retail giant. |
| 2026-08-03 | BLACKBURN'S | Major home healthcare provider data breach. |
| 2026-08-03 | Cameron Regional Medical Center | Patient and employee data breach at a healthcare provider. |
| 2026-07-28 | Prelys Courtage | Client data breach at a major mortgage brokerage franchise. |
| 2026-07-27 | Coca-Cola / Fairlife | Major data breach at company owned by Coca Cola. |
| 2026-07-23 | Eagle Crest Communities | Patient and employee data breach at elderly care service. |
| 2026-07-20 | Bath Fitter | Employee data breach at a major manufacturing company. |
| 2026-07-20 | Fairlife / Coca-Cola | www.fairlife.com |
| 2026-07-13 | Boston Orthotics, Inc. | Patient data breach at yet another negligent clinic. |
| 2026-07-13 | Casper Orthopedics | Orthopedic clinic patients' data and medical records exposed. |
| 2026-07-13 | Surtifamiliar | Passports of supermarket chain employees. |
| 2026-07-13 | Community Advocates | Law firm clients' personal data exposed. |
| 2026-07-03 | Ferrum AG | Data breach at one of the largest family-owned manufacturing businesse… |
| 2026-07-02 | Quest Healthcare Solutions | Employee data, internal files, and a few unexpected discoveries. |
| 2026-07-02 | Northeast Pediatrics & Adolescent Medicine | Data breach exposes employees and patients of a pediatric clinic. |
| 2026-06-29 | ESMS Global Limited | Medical information services data breach. |
| 2026-06-29 | Boston Orthotics & Prosthetics | Patient data breach at yet another negligent clinic. |
| 2026-06-25 | Nachlass Nord | Inheritance lawyers expose IDs, estate records, and client data. |
| 2026-06-25 | Quest Health Solutions | Employee data, internal files, and a few unexpected discoveries. |
| 2026-06-19 | KTR Real Estate Advisors | Real estate client database exposed. |
| 2026-06-15 | KoMiCo | Inside the internal data of a publicly traded company. |
| 2026-06-14 | Power & Tel | Data breach exposes ecommerce platforms’ dirty laundry. |
| 2026-06-14 | EXCEED Energy | Data breach at an international well management specialist. |
| 2026-06-14 | Singing River Health System | New data breach at a large health system provider. |
| 2026-06-14 | D&M Contractors | A small breach, real employee data. |
| 2026-06-14 | FÉTIS Group & SECOM Engineering | Data breach at an engineering company. Financial records, project deta… |
| 2026-05-19 | Colorado Dental Wellness Center | Clients’ medical data breach. |
| 2026-05-19 | A.R.Ge.Co | Accounting firm data breach. |
| 2026-04-23 | Tractial | A small but substantial data breach at a fintech company. |
| 2026-04-23 | Marnell Financial Services | Data breach at financial company. |
| 2026-04-21 | Samuel I. White, PC | Significant breach at a law firm. |
| 2026-04-21 | ViaQuest | Large-scale data breach at a care provider for seriously ill patients. |
| 2026-04-09 | Signature Healthcare | Will there be a release? Keep an eye on the timer. |
| 2026-04-07 | Star Fuels | Data breach at a small fuel company. |
| 2026-04-06 | Tesla Systems | Careless IT contractor jeopardizes client security. |
| 2026-04-04 | Shine Aviation | Aviation firm data breach. |
| 2026-04-01 | Publishers Clearing House | The fall of a sweepstakes giant. |
| 2026-03-27 | Schlam Stone & Dolan LLP | Data breach at a law firm representing clients ranging from government… |
| 2026-03-27 | Scalian | Data breach at a major french IT company. |
| 2026-03-13 | KLA Laboratories | How a single data breach exposed contracts, credentials, and critical … |
| 2026-03-10 | L. S. King and Associates | www.cpageorgia.com - accounting firm data breach. Small dataset, big c… |
| 2026-03-10 | A J Taylor Electrical | Data breach at electrical installation company: drawings, tenders, and… |
| 2026-03-07 | Ladue Family Dental | A major leak of smiles. |
| 2026-03-03 | Andal Law Group | Injury accident law firm data breach: driver IDs and other personal da… |
| 2026-03-02 | AkzoNobel | Data breach at leading global paints and coatings company. |
| 2026-02-26 | Physicians Clinic of Iowa | Clinic data breach: another example of negligence in a medical institu… |
| 2026-02-26 | Envirogen Technologies | Major data breach of Engineering firm with high-profile clients. |
// CONFIRMED ATTACKS
Anubis confirmed attacks: 20 verified incidents
Ransomnews has verified 20 Anubis incidents against named organisations, each corroborated by a public source such as a breach notification, regulatory filing or press report. The confirmed record runs from August 2024 to July 2026. United States accounts for 12 of them (60%), with victims recorded in 7 countries in total. The most affected sector is healthcare, at 8 confirmed victims. A ransom payment was publicly confirmed in 0 cases and publicly refused in 1; the outcome is unrecorded in the remaining 19. Where a figure was disclosed (5 cases), these incidents account for 55,398 exposed records.
Confirmed victims by year
Most affected sectors
Most affected countries
Verified Anubis incidents
| Date | Organisation | Sector | Location | Records | Ransom paid | Source |
|---|---|---|---|---|---|---|
| July 2026 | Fairlife | Food and Beverage | Illinois, United States | — | Unknown | Source |
| June 2026 | Ferrum AG | Manufacturing | Schafisheim, Switzerland | — | Unknown | Source |
| May 2026 | Casper Orthopedics | Healthcare | Wyoming, United States | — | Unknown | Source |
| May 2026 | Bath Fitter | Retail | Quebec, Canada | 183 | Unknown | Source |
| May 2026 | Power & Telephone Supply Company | Retail | Tennessee, United States | 41 | Unknown | Source |
| April 2026 | Signature Healthcare | Healthcare | Massachusetts, United States | — | Unknown | Source |
| March 2026 | AkzoNobel Inc. | Manufacturing | Tennessee, United States | — | Unknown | Source |
| January 2026 | Langley Twigg Law | Legal | Ahuriri, New Zealand | — | Unknown | Source |
| December 2025 | COPEC S.A. | Other | Santiago, Chile | — | Unknown | Source |
| December 2025 | Singing River Health System | Healthcare | Mississippi, United States | 53,888 | Unknown | Source |
| December 2025 | Autorità di Sistema Portuale del Mare Adriatico Centrale | Government | Ancona, Italy | — | Unknown | Source |
| November 2025 | Mid-South Pulmonary & Sleep Specialists P.C. | Healthcare | Tennessee, United States | — | Unknown | Source |
| November 2025 | Trumbull County | Government | Ohio, United States | — | No | Source |
| October 2025 | Smith Fire Systems, Inc. | Service | Washington, United States | 785 | Unknown | Source |
| October 2025 | AllerVie Health | Healthcare | Texas, United States | — | Unknown | Source |
| October 2025 | Paterson & Dowding Family Lawyers | Legal | Perth, Australia | — | Unknown | Source |
| October 2025 | Aussie Fluid Power | Manufacturing | North Coogee, Australia | — | Unknown | Source |
| September 2025 | Dermatology Associates of Concord | Healthcare | Massachusetts, United States | 501 | Unknown | Source |
| November 2024 | Pound Road Medical Centre | Healthcare | Narre Warren South, Australia | — | Unknown | Source |
| August 2024 | Ambleside, Inc. | Healthcare | North Carolina, United States | — | Unknown | Source |
Claimed vs confirmed. The figures above the fold on this page come from Anubis's own leak-site postings and reflect what the operation claims. The table here is a separate evidence class: incidents Ransomnews verified against a public source. Confirmed counts are lower than claimed counts by design — most victims never disclose, and some leak-site listings are recycled, exaggerated or fabricated. Records and ransom figures are shown only where a named source disclosed them. See the full ransomware statistics or the Ransomtracker dataset.