Cleaver-Brooks Listed by anubis Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On August 10, 2026, the ransomware group known as anubis listed Cleaver-Brooks on its leak site, describing what it called a major data incident at a leading industrial manufacturer. That listing is an unverified claim by the group. Cleaver-Brooks has not publicly confirmed the incident as of writing, and independent confirmation from regulators or established breach indexes is not part of the available record.

For employees, customers, suppliers, and others who may have dealt with the company, the practical stakes are straightforward: if any personal or business information were ever taken and published, it could be misused for fraud, phishing, or competitive harm. Until more is known, the responsible approach is to treat the listing as an allegation, watch for official statements, and take measured steps if you have reason to believe your details could be involved.

Inside the listing

According to the listing attributed to anubis, Cleaver-Brooks appears on the group’s leak site. The reported date associated with that appearance is August 10, 2026. The number of people potentially affected is unknown. The types of data the group claims to hold are not disclosed in the available facts. Method of access, timeline of any intrusion, whether files were copied, and whether any ransom demand was made are likewise undisclosed.

Leak-site posts are a form of pressure and marketing used by extortion crews. They do not, by themselves, prove that a breach occurred, that the volume of data is as advertised, or that the material is new rather than recycled or misattributed. Public detail on this specific listing remains limited to the group’s claim and the high-level description that it concerns a major industrial manufacturer.

Inside anubis

Anubis is known publicly as a ransomware and data-extortion operation. Groups in this category typically claim to encrypt systems, exfiltrate files, and threaten to publish or sell data if payment is not made. They often maintain leak sites where they name organizations, post samples or file lists when they choose, and set deadlines meant to increase pressure. Public reporting on anubis and similar crews has described double-extortion patterns: disruption inside a network paired with the threat of exposure.

None of that general pattern confirms what, if anything, happened at Cleaver-Brooks. For this incident, the only attribution in the given record is that anubis has listed the company. Claims the group makes about any single victim should be read as claims until corroborated by the organization, a regulator, or other reliable independent sources.

About Cleaver-Brooks

Cleaver-Brooks is widely known as a manufacturer in the industrial boiler and energy-equipment sector, supplying systems and related services used in commercial and industrial facilities. Organizations in this space typically maintain relationships with plant operators, distributors, contractors, and employees, and they handle engineering, commercial, and operational information as part of normal business.

A credible incident affecting a firm in this sector would matter because industrial suppliers sit in supply chains that can include sensitive commercial terms, facility-related contacts, and workforce data. A leak-site listing alone does not establish that any of that material left the company. It does explain why customers and partners pay attention when a named manufacturer appears on an extortion site: the potential blast radius, if the claim were ever substantiated, would not be limited to a single office.

What was likely exposed

The available facts do not name exposed data types; those details are not disclosed. It is therefore not possible to state what, if any, files were taken. Asserting a specific inventory would go beyond the record and would treat the attackers’ marketing as fact.

If files were taken from an industrial manufacturer of this kind, organizations in the sector typically hold some mix of employee records, customer and supplier contact details, contracts and pricing, service and project documentation, and internal operational material. Whether any of that applies here is unconfirmed. Readers should not assume their information was included solely because a listing exists.

The real-world impact

If personal or business data were involved and later circulated, affected individuals could face targeted phishing, invoice fraud, password-reset scams, or identity misuse. Business partners could see social-engineering attempts that reference real project names or contacts. The organization itself could face reputational strain, customer questions, and the cost of investigation and notification—again, only if an incident is real and material.

A leak-site listing does not by itself prove those outcomes. It also does not establish negligence, weak controls, or failed detection at Cleaver-Brooks; those conclusions would require a verified incident and a proper investigation, neither of which is in the facts provided. What the listing does establish is that an extortion group has chosen to name the company publicly, which is enough reason for cautious monitoring and for conditional precautions by people who have a relationship with the firm.

If your data was involved

If you believe your information may have been held by Cleaver-Brooks and could be implicated if the group’s claim were accurate, take calm, practical steps. Prefer official channels for any company notice rather than messages that arrive unexpectedly with urgent payment or credential requests. Watch financial and email accounts for unusual activity. Use unique passwords and multi-factor authentication where available, and treat unsolicited links or attachments with skepticism—especially messages that reference a breach or a supplier relationship.

Consider freezing credit if you are in a jurisdiction where that is straightforward and you have a concrete reason for concern. Keep records of any suspicious contact. For a basic check on whether your email address has already appeared in other known breach datasets, you can run a free exposure scan of your email through a reputable breach-notification service. That kind of scan does not confirm or deny this specific listing; it only helps you see whether your address has shown up in previously compiled breach corpora, which can guide how tightly you lock down reuse of passwords and recovery options.

AICompiled with AI assistance from public sources and published under our editorial standards.