ESMS Global Limited Listed by anubis Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

ESMS Global Limited, a provider of medical information services, was listed by the Anubis ransomware group on 29 June 2026. The listing states that internal files were exfiltrated during a ransomware attack. The number of individuals affected remains unknown, and no further details on the scope or contents of the data have been made public. This incident reflects the continued targeting of organisations that hold sensitive operational and sector-specific records by ransomware groups that combine encryption with data theft.

Inside the incident

The only confirmed information is the group’s listing of ESMS Global Limited on 29 June 2026 and the claim that internal files were removed. No figure for the volume of data, the number of people affected, or the timeline of the intrusion has been disclosed. The precise method of initial access and whether files were encrypted on the organisation’s systems are also not reported.

Inside anubis

Anubis is a ransomware operation that maintains a public leak site to list organisations from which it claims to have stolen data. The group typically follows a double-extortion pattern: encrypting systems and threatening to publish exfiltrated material if a ransom is not paid. Its listings are presented by the group itself and are not independently verified at the time of publication.

About ESMS Global Limited

ESMS Global Limited operates in the medical information services sector. Organisations of this type routinely process records that support clinical, administrative and regulatory functions. A breach affecting such an entity can expose both operational documents and data that relate to individuals receiving care or participating in medical processes.

The information in question

The listing refers only to “internal files exfiltrated in ransomware attack.” No inventory of file types, patient identifiers, or other categories has been released. While entities in this sector commonly hold clinical correspondence, laboratory results, billing records and staff documentation, the exact contents of the material claimed by the group remain unconfirmed.

Why it matters

Exposure of internal files from a medical information services provider can create long-term risks for individuals whose records are involved, including potential misuse of personal or health-related details. For the organisation, the incident adds operational disruption, possible regulatory scrutiny and the need to manage any downstream consequences of data appearing in public or criminal channels.

If your data was in this claimed breach

Monitor bank, insurance and government accounts for unusual activity and enable multi-factor authentication where available. Request copies of your medical records from relevant providers to check for discrepancies. Individuals can also run a free exposure scan of their email address against known breach data to determine whether their information has appeared in previously published datasets.

AICompiled with AI assistance from public sources and published under our editorial standards.