Gaedke & Partner Steuerberatung targeted by Anubis ransomware group

• Ransomware group: Anubis
• Country: Germany
• Sector: Professional Services
• Announcement date: September 22, 2026

The Anubis ransomware group has published a notice on its leak site, claiming to have compromised the data of the German accounting firm Gaedke & Partner Steuerberatung. This announcement, made on September 22, 2026, marks a new instance of a targeted attack against a professional services provider.

The claims made by Anubis

According to the announcement posted on the group's leak site, the Anubis group claims to have successfully obtained sensitive financial data and client information belonging to Gaedke & Partner Steuerberatung. The group listed the firm on their platform on September 22, 2026, the same date they claim the attack occurred.

The claim is supported by the group's publication of various documents that appear to be related to the firm's operational processes. While the group has provided these materials to support their claims, public information regarding the specific tactics, techniques, and procedures of the Anubis group remains limited. The group's specific demands and the exact volume of data stolen have not been disclosed in the available information.

Data types involved in the alleged leak

The screenshots provided by the threat actors suggest that the breach involves highly sensitive documentation. The leaked materials reportedly include various financial and personal records that could be used for malicious purposes. The specific types of data identified include:

• Financial statements
• Tax returns
• Personal identification documents (passports/ID cards)

The presence of such sensitive information highlights the high-value nature of the target. When ransomware groups target professional services, they often seek out documents that can be used for further exploitation or extortion.

About Gaedke & Partner Steuerberatung

Gaedke & Partner is a tax consultancy and accounting firm based in Munich, Germany. The company provides a range of specialized services to both corporate and individual clients, including tax planning, financial reporting, and various advisory services. Given the nature of their business, the firm handles a significant volume of sensitive financial and personal information for its client base.

Analysis and potential impact

The data allegedly leaked in this incident may pose significant risks to the firm's clients and employees. Specifically, the exposure of personal identification documents, such as passports and ID cards, increases the risk of identity theft. Furthermore, the availability of financial statements and tax returns could facilitate targeted phishing attacks, where attackers use specific financial details to gain trust during a social engineering attempt.

Because the firm is based in Germany, this incident may lead to data protection violations under the General Data Protection Regulation (GDPR). The accounting sector is particularly vulnerable to such leaks because the sensitive financial information it manages is a primary target for cybercriminals. Additionally, the firm's supply chain partners may also face similar risks as a result of this breach.

The methods employed by the Anubis group in this case may indicate the use of a double extortion strategy. In a double extortion scenario, attackers not only encrypt a victim's data to disrupt operations but also steal sensitive information to threaten the victim with its public release unless a ransom is paid. This approach increases the pressure on organizations to comply with demands. To defend against such threats, organizations in the professional services sector often implement multi-factor authentication, regular security awareness training, and robust data encryption protocols to mitigate the impact of potential breaches.