Storage King listed on Anubis ransomware leak site

• Ransomware group: Anubis
• Country: Australia
• Sector: Retail & E-Commerce
• Announcement date: September 30, 2025

Anubis claims data breach at Storage King

The threat actor known as Anubis has listed Storage King on its leak site, claiming to have obtained sensitive data from the organization. This announcement, made on September 30, 2025, suggests a significant security incident involving the UK-based company. According to the claims made by the group, the breach involves sensitive information belonging to the organization's customers.

In modern cyberattack landscapes, ransomware groups often employ a tactic known as double extortion. In these scenarios, attackers do not merely encrypt an organization's files to disrupt operations; they also exfiltrate sensitive data to use as leverage. By threatening to publish stolen information on public leak sites, these groups aim to pressure victims into paying a ransom to prevent the exposure of private data. The listing of a target on a leak site is a common method used by these actors to demonstrate the success of their intrusion and to increase the pressure on the victimized entity.

Details of the alleged data theft

The Anubis group alleges that the compromised data includes personal information belonging to customers as well as visual documentation of the company's operations. Specifically, the group claims that photographs of storage units have been part of the stolen dataset. To support their claims, the group has shared sample images that contain highly sensitive information, including customer passport details and various contact details.

The specific types of data identified in the claim include:

• Passport data
• Customer contact information
• Storage unit photographs

The inclusion of identity documents such as passport scans significantly elevates the severity of the alleged leak. Such information is highly prized by malicious actors for various illicit purposes.

About Storage King

Storage King is a UK-based company that provides self-storage solutions for both personal and business customers. The organization offers a variety of secure storage units of different sizes available for rent to meet the diverse needs of its clientele.

Implications and risks

The alleged leak of this information may increase the risk of identity theft and fraud for the affected customers. Because the shared sample data contains sensitive information, it could be utilized by attackers to conduct highly targeted spear-phishing campaigns. Spear-phishing involves using specific, personal details to craft convincing fraudulent communications designed to trick individuals into revealing even more sensitive information or performing actions that compromise their security.

Furthermore, the organization may face legal and regulatory consequences. Depending on the jurisdiction and the nature of the data, legal proceedings and administrative sanctions may arise in accordance with the data protection regulations applicable to the organization's region. Such regulations often mandate that organizations fulfill specific data breach notification obligations, which include informing the affected customers about the incident and the types of data involved.

For organizations operating in the retail and e-commerce sectors, maintaining robust cybersecurity posture is essential to mitigate these risks. Common defensive steps include implementing multi-factor authentication, maintaining strict access controls, and conducting regular security audits. Additionally, organizations should have a well-defined incident response plan to manage the complexities of a data breach and ensure compliance with regional legal requirements. Information regarding the Anubis group remains limited, and their specific motivations and technical capabilities remain uncertain.