ESMS Global Limited targeted by Anubis ransomware group

• Ransomware group: Anubis
• Country: United Kingdom
• Sector: Professional Services
• Announcement date: June 29, 2026

Anubis ransomware group claims data breach at ESMS Global Limited

The Anubis ransomware group has published an announcement on its leak site, claiming that it has targeted ESMS Global Limited. According to the claim made on June 29, 2026, the group has released various documents on its platform that are alleged to have been obtained directly from the organization's systems. While the group has made this claim, public information regarding the specific capabilities and background of the Anubis group remains limited.

Details of the alleged data leak

The information disclosed by the threat actor includes various sensitive documents. Screenshots shared on the leak site suggest that the breach involves highly confidential information. The data allegedly obtained by the group includes the following categories:

• Patient health records
• Clinical trial data
• Passport copies
• Identity documents

The nature of these files suggests a significant breach of sensitive information. It is important to note that the group has not provided specific details regarding the total size of the data stolen or the exact number of files involved in the incident. Furthermore, there has been no mention of a specific ransom demand in the announcement.

About ESMS Global Limited

ESMS Global Limited is an organization that provides medical information services and data management solutions for the healthcare sector. Based in the United Kingdom, the company operates within the professional services sector, specifically focusing on the intersection of healthcare and data management.

Risk assessment and implications of the breach

Given the sensitive nature of the alleged leaked data, there are significant risks for the individuals involved. The exposure of medical records and identity documents, such as passport copies, means that affected individuals may be at risk of identity theft and targeted phishing attacks. Such attacks often leverage personal details to gain further access to accounts or to conduct fraudulent activities.

Because the organization is based in the United Kingdom, this incident may be subject to investigation by data protection authorities under the UK GDPR. The disclosure of medical data is particularly serious, as it could lead to violations of patient privacy rights and cause significant damage to the professional reputation of the organization.

The tactics employed by the group appear to follow the pattern of double extortion. In a double extortion scenario, ransomware actors do not just encrypt an organization's data to disrupt operations; they also steal sensitive information to use as leverage. By threatening to publish the data on a public leak site, the group aims to exert maximum pressure on the organization to meet their demands.

For organizations operating in the healthcare and professional services sectors, incidents of this nature highlight the critical importance of robust data security processes. To mitigate such risks, organizations should prioritize the review of their data protection frameworks and ensure they have clear protocols for notifying affected parties. Maintaining rigorous access controls, encryption for data at rest and in transit, and continuous monitoring of network activity are standard defensive measures used to protect against such threats.