Loading story…
Dutch paint manufacturer AkzoNobel confirmed a network breach at one of its U.S. sites, with the Anubis ransomware operation claiming responsibility and alleging theft of ~170GB (about 170,000 files) of data. Reported stolen materials include confidential client agreements, employee contact details, private emails, passport scans, and technical documents; AkzoNobel said the incident was contained and impact was limited, and it did not disclose whether negotiations are underway. Reporting also noted Anubis’ evolution as a ransomware-as-a-service (RaaS) operation and prior use of a data-wiper capability intended to destroy files beyond recovery.
Separately, the University of Mississippi Medical Center (UMMC) reported it restored normal clinic operations after a ransomware attack disrupted electronic medical records, phone lines, and multiple IT systems for nine days; no group had publicly claimed the intrusion, though officials said they were in contact with the attackers and working with authorities and specialists. Additional context on the broader ransomware landscape included a February tally of publicly disclosed incidents across sectors and geographies, and technical reporting showing how a successful brute-force login against exposed RDP can lead to domain enumeration, credential-hunting, and identification of geo-distributed infrastructure tied to a RaaS ecosystem and initial access brokers—highlighting continued risk from internet-exposed remote access services and credential-based intrusion paths.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
The Anubis ransomware gang claimed responsibility for the AkzoNobel breach, alleging it stole about 170GB of data comprising roughly 170,000 files. The purportedly exposed material includes client agreements, employee contact details, private emails, passport scans, and technical documents.
AkzoNobel confirmed that one of its U.S. sites experienced a network breach. The company indicated the incident had been contained and that the impact was limited.
UMMC said phone lines were restored, clinics reopened, and patients were being contacted to reschedule missed appointments after the ransomware-related disruption. The medical center also said it was working with the FBI, CISA, and outside specialists while communicating with the attackers and assessing next steps.
The University of Mississippi Medical Center suffered a ransomware attack that caused a nine-day disruption, blocking access to electronic medical records and taking down many IT systems. The incident forced cancellations of outpatient procedures, ambulatory surgeries, and imaging appointments, while hospital services continued under downtime procedures.
The Anubis ransomware-as-a-service operation began activity in December 2024. Reporting later noted it had used a data-wiping capability that can permanently destroy files.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple organizations disclosed or were linked to **ransomware/data-extortion** activity with material operational or privacy impact. **Air Côte d’Ivoire** confirmed a cyberattack affecting parts of its information systems after **INC ransomware** claimed theft of **208 GB** and threatened to leak data, while the airline said it engaged the national CERT and external experts to contain impact and maintain flight operations. In the US healthcare sector, **University of Mississippi Medical Center (UMMC)** reported a ransomware incident that forced statewide clinic closures and disrupted access to **Epic** electronic medical records, prompting engagement with the **FBI** and **CISA** and use of downtime procedures to sustain patient care. Separately, **Conduent**’s earlier ransomware-linked breach continued to expand in scope, with breach notifications indicating at least **~25 million** people affected across multiple states and exposure of sensitive PII (including **SSNs** and health/insurance data). **Wynn Resorts** also confirmed an unauthorized party accessed and stole employee data after being listed by the **ShinyHunters** extortion group, with the company stating the actor claimed the data was deleted and that guest operations were not impacted. Other items in the set describe distinct, unrelated security events and broader threat research rather than the same incident: alleged data leaks involving **Burger King France** and **Wendy’s UK**; **Qilin** ransomware claims against a New York City transit union; Russian cyber operations against Ukraine’s power grid focused on intelligence collection; and a New Zealand healthcare application (**MediMap**) taken offline after apparent unauthorized access and **patient record tampering** (e.g., records marked deceased). Additional references cover threat research and trends (airline brand impersonation domains, edge-device exploitation telemetry, MuddyWater’s *Operation Olalampo*, Google Ads cloaking via **1Campaign**, freight/logistics phishing by “Diesel Vortex,” and various governance/AI/5G/quantum commentary), which provide context on the threat environment but do not substantively report on the same specific breach event.
Jun 29, 2026
French industrial supplier **LISI Group** confirmed a cybersecurity incident affecting two ancillary sites after the **Qilin** ransomware gang claimed responsibility. The company said only a limited amount of information was stolen and that core operations and infrastructure were not impacted; however, data samples attributed to Qilin reportedly included internal business documents and sensitive records such as bank-transfer screenshots, bank account details, employee forms, contracts, and partner-related documentation. Dutch paints and coatings firm **AkzoNobel** also confirmed a contained intrusion limited to a single U.S. site following a leak attributed to the **Anubis** ransomware operation. Anubis claimed theft of roughly **170GB** (nearly **170,000 files**) and published partial leak samples allegedly including confidential client agreements, internal correspondence, passport scans, material testing documents, and technical specification sheets; AkzoNobel stated it is notifying impacted parties and coordinating with authorities. Separately, a BlackFog monthly ransomware roundup reported **82** publicly disclosed ransomware incidents in February 2026 (healthcare most targeted) and highlighted other claimed/extortion cases (e.g., **Everest** claims involving Hosokawa Micron and Iron Mountain), but it did not provide additional corroboration on the LISI Group or AkzoNobel incidents.
Jun 29, 2026
Reporting highlighted elevated ransomware activity and evolving access-broker ecosystems. BlackFog’s February ransomware roundup counted **82 publicly disclosed ransomware incidents** across **20 countries**, with the **U.S.** most affected (51 incidents) and **healthcare** the most targeted sector (31%). The report attributed publicly claimed attacks to **24 ransomware groups**, led by **Shiny Hunters** (8) and **Qilin** (6), while noting **41%** of incidents were not yet attributed; it also cited individual victim disclosures/claims involving **Nova Biomedical** (PII exposure affecting 10,764 people), **Hosokawa Micron** (files accessed; **Everest** claimed ~30GB theft), and **Iron Mountain** (Everest claim of 1.4TB theft, while Iron Mountain stated access was limited to a single marketing folder via a compromised credential). Separately, Huntress described how investigation of a “routine” **RDP brute-force** success led to discovery of credential-hunting behavior and **geo-distributed infrastructure** consistent with a **ransomware-as-a-service** ecosystem and associated initial access activity, illustrating how exposed remote access can connect to broader ransomware operations. Arctic Wolf warned of **heightened cyber risk** following the February 2026 U.S./Israel-Iran escalation (*Operation Epic Fury*), advising increased vigilance—especially for sectors historically targeted by Iranian-linked actors (e.g., energy, defense, transportation, healthcare, government)—and anticipating potential **wiper activity, DDoS, targeted intrusions, supply-chain risk**, and possible collaboration with ransomware-affiliate activity amid geopolitical retaliation dynamics.
Jun 29, 2026