ANUBIS

Active
113 victims named on the leak site
6 in the last 30 days
94 in the last 12 months
Feb 2025 first victim we recorded
Sep 23, 2026 most recent victim posted
2 leak sites tracked

Data as of October 1, 2026.

Credential exposure before the attack

31% of ANUBIS victims whose domain we can identify (35 of 113) had employee credentials leak in the 12 months before ANUBIS named them as a victim.

We don't know whether any of these credentials were how ANUBIS gained initial access.

What industries ANUBIS targets

Sector identified for 86 of 113 victims.

Healthcare26
Manufacturing18
Legal10
Financial Services8
Hospitality4
Logistics4
Construction4
Energy3

Where the victims are located

Country identified for 99 of 113 victims.

United States56
United Kingdom10
France8
Australia6
Canada5
Italy2
South Korea2
Chile1

Most recent ANUBIS victims

VictimSectorCountryPosted
Gaedke & Partner Steuerberatung gaedke.co.atNot identifiedAustriaSep 23, 2026
Summa Gold summagold.comNot identifiedPeruSep 22, 2026
Quest Group questgroupsearch.comNot identifiedUnited StatesSep 21, 2026
Better Accounting Solutions betteraccountingsolutions.comFinancial ServicesNot identifiedSep 15, 2026
Gellibrand Support Services gellibrand.org.auNot identifiedAustraliaSep 10, 2026
Marlborough Partners marlboroughpartners.comNot identifiedUnited KingdomSep 3, 2026
Caduceus Medical Group caduceusmedicalgroup.comHealthcareUnited StatesAug 31, 2026
Scholle IPN scholleipn.comManufacturingUnited StatesAug 19, 2026
Interim HealthCare interimhealthcare.comHealthcareUnited StatesAug 17, 2026
Cleaver-Brooks cleaverbrooks.comNot identifiedUnited StatesAug 11, 2026
Blackburn\'s blackburnsmed.comHealthcareUnited StatesAug 4, 2026
Cameron Regional Medical Center cameronregional.orgHealthcareUnited StatesAug 4, 2026
Winn-Dixie winndixie.comRetailUnited StatesAug 4, 2026
The Coca-Cola coca-colacompany.comManufacturingUnited StatesJul 28, 2026
Prelys Courtage prelys-courtage.comFinancial ServicesFranceJul 28, 2026
Eagle Crest Communities eaglecrestlife.orgHealthcareUnited StatesJul 24, 2026
Bath Fitter bathfitter.comNot identifiedNot identifiedJul 21, 2026
Fairlife fairlife.comManufacturingUnited StatesJul 21, 2026
Community Advocates communityadvocates.netEnergyUnited StatesJul 13, 2026
Surtifamiliar surtifamiliar.comRetailColombiaJul 13, 2026

Showing the 20 most recent of 113. Browse recent data breaches for more.

ANUBIS leak sites

Addresses we've seen ANUBIS publish victims from. Any .onion address needs the Tor Browser.

  • om6q4a6cyipxvt7ioudxt24cw4oqu4yodmqzl25mqd2hgllymrgu4aqd.onion
  • anubisyfkh5rixydjpoo3jqucauajz2juybrbtuglcppjj2y3eg3y6ad.onion

ANUBIS questions

Is ANUBIS still active?

Yes. ANUBIS posted its most recent victim on September 23, 2026. That's 6 victims in the last 30 days.

How many victims has ANUBIS claimed?

ANUBIS has named 113 victims on its leak site since we started tracking it. That counts organizations, not leaked files. A single victim often accounts for thousands of published files. 94 of them were posted in the last 12 months.

When did ANUBIS first appear?

The first victim we recorded for ANUBIS was posted on February 26, 2025. That's when the group entered our collection, which isn't necessarily when it started operating.

Which sectors does ANUBIS target?

Healthcare accounts for the most victims we can classify, with 26. Manufacturing follows at 18. We could identify a sector for 86 of 113 victims, so treat this as the shape of the targeting rather than a full census.

Has ANUBIS already got your credentials?

Check whether your employees' logins have leaked on the dark web before they're exploited.

Check your exposure →

Continuous dark web monitoring alerts you when your company's data shows up, whether that's employee credentials or files published after an attack.