Surtifamiliar listed on Anubis ransomware leak site

• Ransomware group: Anubis
• Country: Colombia
• Announcement date: July 12, 2026

Anubis claims to have compromised Surtifamiliar data

The threat actor known as Anubis has officially listed the Colombian supermarket chain Surtifamiliar on its dedicated leak site. According to the announcement made on July 12, 2026, the group claims to have successfully executed a cyberattack against the organization. While the specific nature of the initial intrusion remains unconfirmed, the group asserts that they have gained access to sensitive information belonging to the company.

The incident, which the threat actor claims occurred on July 12, 2026, marks a new development in the activity of the Anubis group. Information regarding this specific threat actor remains limited in the public domain, making it difficult to establish a comprehensive profile of their typical tactics, techniques, and procedures. Ransomware groups often utilize leak sites as a tool for double extortion, a method where attackers not only encrypt an organization's data but also threaten to publish sensitive information to pressure the victim into paying a ransom.

Claims regarding compromised data

The leak announcement provided by Anubis specifically targets the personal documentation of the workforce. The group claims to possess sensitive identification documents that could pose significant risks to the individuals involved. It is important to note that the threat actor has not provided any screenshots to substantiate these claims, and the total volume of data or the specific file count has not been disclosed.

The data reportedly involved in this incident includes:

• Employee passport information

The exposure of such highly sensitive personal identifiers is a critical security concern. In the context of modern cyberattacks, the theft of identity documents is often used to facilitate further malicious activities or to increase the leverage held by the attacker during extortion negotiations.

About Surtifamiliar

Surtifamiliar is a supermarket chain based in Colombia. The organization provides essential retail services, focusing on the distribution and sale of basic food products and various household needs for the local population.

Potential risks and organizational implications

The claims made by Anubis suggest that employees of Surtifamiliar may be exposed to significant secondary risks. The theft of passport information is particularly dangerous as it can lead to identity theft and various forms of financial fraud. When sensitive personal data is leaked, organizations often face complex challenges, including potential legal and administrative sanctions under local data protection regulations, such as those governing data privacy in Colombia.

Beyond the immediate impact on individuals, such breaches can result in lasting reputational damage for the organization. Furthermore, the exposure of employee data can lead to secondary technical risks, such as targeted phishing attacks directed at the staff. These sophisticated social engineering attempts can be used to bypass security perimeters and pose additional risks to the corporate network security.

To defend against such threats, organizations typically implement multi-layered security strategies. This includes robust access controls, continuous monitoring of network traffic, and comprehensive employee training to recognize phishing attempts. Maintaining strict data minimization practices and ensuring that sensitive identification documents are encrypted and stored securely are also fundamental defensive steps in mitigating the impact of potential data exfiltration.