DRL Group data allegedly leaked by Anubis ransomware group

• Ransomware group: Anubis
• Country: India
• Sector: Professional Services
• Announcement date: October 1, 2025

Anubis claims to have compromised DRL Group data

The threat actor known as Anubis has published data allegedly belonging to DRL Group on its leak site. According to the announcement made on October 1, 2025, the group claims to have successfully carried out a cyberattack against the organization.

The Anubis group has listed information it claims belongs to DRL Group on its leak site. The threat actor alleges that it has compromised customer data and has shared various personal and financial records as samples to support its claims. Publicly available information regarding this specific threat group remains limited, making it difficult to ascertain the full scope of their operations or typical methodologies.

Ransomware groups often utilize leak sites as a tool for double extortion. In such scenarios, attackers do not only encrypt an organization's systems but also steal sensitive data to pressure the victim into paying a ransom. If the ransom is not met, the stolen information is published on these public platforms to maximize reputational damage and pressure the target through public exposure.

Details of the allegedly leaked information

The content of the alleged leak is significant, involving a variety of sensitive information categories. The threat actor claims to have obtained a range of personal and financial records belonging to the organization's clients. The specific data types mentioned in the claim include:

• Customer contact information
• Financial account details
• Transaction history

The specific details provided in the samples include customer names, phone numbers, email addresses, home addresses, account numbers, balance information, and transaction histories. No information was provided regarding the total size of the data or the specific file count involved in the breach.

Organization profile

The target of this alleged attack is DRL Group, a professional services organization based in India. While the specific nature of their professional services is not detailed, the exposure of the data mentioned suggests a high level of sensitivity regarding the information they manage for their clients.

Risk assessment and organizational implications

The allegedly leaked data may increase the risk of customers being subjected to identity theft and targeted phishing attacks. When personal identifiers such as names, addresses, and contact details are combined with financial information, the potential for social engineering attacks increases significantly. Furthermore, the exposure of financial data could lead to reputational damage for the organization and financial loss for the customers.

As the organization is based in India, local data protection regulations may be relevant in the event of a data breach. Organizations facing such incidents may need to notify affected customers and review its security measures to prevent future occurrences. Secondary risks may include the use of leaked information in further cyberattacks, such as credential stuffing or more sophisticated phishing campaigns.

To mitigate such risks, organizations in the professional services sector often implement defensive strategies such as multi-factor authentication, robust encryption for data at rest and in transit, and continuous monitoring of network traffic. Regular security audits and employee training on phishing awareness are also standard practices to reduce the likelihood of successful initial access by threat actors.