AkzoNobel targeted in data breach claim by Anubis ransomware group

• Ransomware group: Anubis
• Country: Netherlands
• Sector: Manufacturing
• Announcement date: March 2, 2026

Anubis claims data breach against AkzoNobel

The threat actor known as Anubis has published data allegedly belonging to AkzoNobel on its leak site. This announcement, made on March 2, 2026, marks a significant claim of a successful cyberattack against the multinational corporation. In the evolving landscape of cybercrime, ransomware groups often utilize leak sites to pressure victims through a method known as double extortion. In such scenarios, attackers do not only encrypt an organization's systems but also exfiltrate sensitive data, threatening to release it publicly if a ransom is not met. This tactic aims to maximize leverage by threatening the victim's reputation and legal standing.

The Anubis group announced this data breach targeting AkzoNobel on March 2, 2026. According to the group's claims, the breach involved the theft of various documents, including internal correspondence, confidentiality agreements, and financial reports. While the group has taken responsibility for the attack, information regarding the specific identity and operational details of the Anubis group remains limited in the public domain.

Details of the allegedly leaked data

The information released by the threat actor appears to be diverse, covering multiple aspects of the organization's internal operations and administrative records. The variety of the published data suggests that the organization's internal operational processes may have been significantly exposed. The leaked data includes several types of sensitive documentation that could be used for various malicious purposes.

The specific items identified in the claim include:

• Employee information
• Financial reports
• Confidentiality agreements
• Identification documents
• Technical analysis reports

The inclusion of such a wide array of data types—ranging from financial records to personal identification documents—indicates a potentially deep penetration into the company's digital environment. When such a broad spectrum of data is exfiltrated, it often complicates the recovery process for the victim organization, as the impact extends beyond mere operational downtime to include long-term privacy and legal concerns.

About AkzoNobel

AkzoNobel is a Dutch multinational company that operates in the paints and performance coatings sector. It is a leading global manufacturer providing industrial and decorative paint solutions. As a major player in the manufacturing sector, the company maintains extensive operations that involve complex supply chains and a large workforce, making it a high-value target for sophisticated threat actors.

Impact and organizational risks

This breach may pose secondary risks such as identity theft and targeted phishing attacks for AkzoNobel employees and business partners. When personal identification documents and employee information are leaked, the risk of social engineering attacks increases, as attackers can use the stolen details to craft highly convincing fraudulent communications. Furthermore, the breach of corporate confidentiality could negatively impact the company's reputation and market value.

Given that the organization is based in the Netherlands, the leaked data may fall under the scope of the European Union's General Data Protection Regulation (GDPR). Such regulatory frameworks impose strict requirements on how personal data is protected and how breaches must be reported. The exposure of financial reports and technical analysis reports further compounds the risk to the company's competitive advantage and strategic security.

In the manufacturing sector, organizations often face significant risks from data exfiltration. To mitigate these threats, companies typically focus on robust defensive measures, such as implementing multi-factor authentication, maintaining strict network segmentation to prevent lateral movement by attackers, and conducting regular security awareness training to help employees recognize phishing attempts. Additionally, maintaining comprehensive logging and monitoring systems is essential for the early detection of unauthorized data movement.