Samkwang listed on Anubis ransomware leak site

• Ransomware group: Anubis
• Country: South Korea
• Sector: Manufacturing
• Announcement date: February 13, 2026

Anubis ransomware group claims data breach at Samkwang

The Anubis ransomware group has officially listed the South Korean manufacturing organization Samkwang on its dedicated leak site. According to the group's announcement, they have successfully exfiltrated technical data and various forms of internal information belonging to the company. This claim was made on February 13, 2026, coinciding with the date the group alleges the attack occurred.

Ransomware attacks often involve a tactic known as double extortion. In these scenarios, threat actors do not merely encrypt an organization's systems to disrupt operations; they also steal sensitive data to use as leverage. By threatening to publish this information on a public leak site, the attackers aim to pressure the victim into paying a ransom to prevent the disclosure of proprietary or sensitive information. While the specific ransom demand and the total volume of stolen data have not been disclosed by the group, the threat of exposure remains a primary driver for such criminal activities.

Details of the alleged data leak

The Anubis group has released several images as evidence of the breach. These screenshots reportedly contain sensitive information that may be linked to Samkwang as well as other major technology companies based in South Korea, such as Samsung. The leaked materials are claimed to include highly sensitive documentation that outlines internal business operations and proprietary technical details.

The content identified in the published screenshots includes a wide range of corporate and technical assets. The specific types of data allegedly involved in this incident are:

• Technical drawings
• Production reports
• Quality control documents
• Internal correspondence
• Trade secrets

The presence of such diverse documentation suggests that the attackers may have gained access to various departments within the organization, ranging from engineering and production to administrative and legal communications.

Potential impact and organizational risks

The disclosure of the alleged data poses significant risks to Samkwang. The leaked information, which reportedly includes product schematics and production process reports, could potentially harm the organization's intellectual property rights and its overall competitive advantage in the manufacturing sector. When technical drawings and trade secrets are made public, it becomes difficult for a company to protect its unique manufacturing processes and designs from competitors.

Furthermore, the leaked internal correspondence regarding relationships with third-party technology companies, such as Samsung, introduces substantial risks to supply chain security. The exposure of these business relationships may lead to breaches of contractual obligations between Samkwang and its partners. Such incidents can undermine the trust and credibility that an organization maintains with its business partners and clients.

Beyond the immediate commercial impact, the organization may face legal challenges. Given the nature of the data, it is possible that the company could face legal proceedings under South Korean data protection regulations. Additionally, the publication of this information may increase the risk of secondary attacks, as the leaked data can be used by other threat actors to conduct more targeted social engineering or technical campaigns against the organization.

Defensive considerations for the manufacturing sector

For organizations operating in the manufacturing sector, protecting intellectual property and maintaining supply chain integrity is critical. To mitigate the risks associated with ransomware and data exfiltration, companies often implement layered security strategies. This includes robust access controls to ensure that sensitive technical drawings and production reports are only available to authorized personnel. Monitoring internal network traffic can help detect unauthorized data movement before it reaches a leak site.

In an era of interconnected supply chains, maintaining strict security standards is not just a matter of internal protection but also a requirement for fulfilling contractual obligations to larger technology partners. Organizations must prioritize the protection of trade secrets and internal correspondence to prevent the loss of competitive advantage and to avoid the legal and reputational consequences that follow a public data breach.