AkzoNobel Confirms Contained Cyber Incident at U.S. Site After Anubis Data Leak
Summary
AkzoNobel says it contained an incident at a U.S. site and impact is limited. Anubis claims it stole 170GB and nearly 170,000 files, posting samples that reportedly include agreements, passport scans, and technical documents.
Key points
- AkzoNobel confirmed a security incident at one U.S. site and said it was contained and its impact limited.
- Anubis claims it stole 170GB and nearly 170,000 files; the group posted partial samples and a list of files.
- The published samples reportedly include client agreements, correspondence, passport scans, material-testing documents, and internal technical specifications.
- AkzoNobel says it is notifying and supporting impacted parties and working with relevant authorities.
- The company did not say whether it engaged with Anubis.
- Anubis is described as a ransomware-as-a-service operation that added a data wiper in June 2025.
Article Details
- Victim Organization
- AkzoNobel
- Incident Type
- Cyberattack and network breach at one of AkzoNobel’s U.S. sites; Anubis identifies the incident as ransomware-related.
- Data Types Exposed
- Confidential client agreements
- Email addresses and phone numbers
- Private email correspondence
- Passport scans
- Material testing documents
- Internal technical specification sheets
- Affected Records
- Anubis claims nearly 170,000 files were stolen; this volume has not been independently confirmed.
- Affected Data Size
- Anubis claims 170 GB of data was stolen; this volume has not been independently confirmed.
- Operational Impact
- AkzoNobel says the incident was limited to the affected U.S. site, contained, and had limited impact. No further operational disruption is reported.
- Ransom Or Extortion
- Anubis posted samples of data it claims to have stolen and continued publishing files. AkzoNobel did not disclose whether it engaged with the threat actor; no ransom demand or payment is reported.
- Claim Status
- confirmed