Gellibrand Support Services Listed by Anubis Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On 9 September 2026, the ransomware group Anubis listed Gellibrand Support Services on its leak site. That listing is an unverified claim by the group. As of writing, Gellibrand Support Services has not publicly confirmed the claim, and no regulator or independent breach index is cited in the available record as having verified it.

Public detail is limited. The number of people who might be affected is unknown, and the listing does not name specific data types. What is known so far is only that Anubis has published the organisation’s name in connection with an alleged incident. For anyone who has dealt with a disability or community support provider, that kind of claim still warrants careful, conditional attention—without treating the group’s marketing as established fact.

Inside the listing

According to the available record, Anubis has listed Gellibrand Support Services on its leak site, with the report dated 9 September 2026. The reported summary attached to the listing is brief and promotional in tone: it refers to “a data breach at a company full of smiling patients.” That phrasing is the group’s own characterisation, not an independent description of events.

The listing does not disclose how many people might be involved, what systems were supposedly accessed, what files—if any—were taken, or what method was used. Scale, timing beyond the report date, and technical detail are undisclosed. Nobody outside the claimants has confirmed that data left the organisation’s control. A leak-site entry establishes that a group chose to name a victim and make a claim; it does not, by itself, establish that the claim is accurate, complete, or new.

Readers should treat the Anubis listing as an accusation pending confirmation, exaggeration, recycling of older material, or falsehood—all of which remain possible until the organisation or another authoritative source speaks with evidence.

Inside Anubis

Anubis is a ransomware and extortion actor known in public reporting for encrypting systems and threatening to publish stolen data if demands are not met. Like other groups in this category, it typically relies on leak-site pressure: naming organisations, posting samples or descriptions when it chooses, and setting deadlines meant to force negotiation. Public accounts of such crews often describe initial access through common paths—phishing, exposed remote services, or stolen credentials—followed by movement inside a network and data staging before encryption or pure extortion. Those are general patterns associated with the ecosystem, not proven steps in this specific case.

For this listing, the group claims Gellibrand Support Services is a victim. Beyond that naming and the short summary in the record, no further Anubis statements unique to this organisation are provided in the facts. Prior public activity by Anubis against other entities does not prove what happened here. Leak sites are instruments of coercion; their contents are selected and framed to maximise pressure, not to serve as audited inventories.

Who is Gellibrand Support Services?

Gellibrand Support Services is a named organisation operating in the disability and community support sector—work that typically involves helping people with day-to-day living, care coordination, and related services. Organisations in this field routinely hold information needed to deliver support: identity and contact details, health and disability-related records, support plans, billing and funding information, and correspondence with families, carers, and government schemes.

A credible incident affecting such a provider would matter because the people served often depend on continuity of care and may be less able to absorb identity or privacy harm. Even an unconfirmed leak-site claim can cause worry among clients, staff, and partners. That consequence flows from the sensitivity of the sector and the public nature of the accusation, not from any verified proof that systems were compromised. The listing does not establish negligence, weak controls, or cultural failings at Gellibrand Support Services; it establishes only that Anubis chose to publish the name.

What data was at risk

The facts state that data types named as exposed are not disclosed. It is therefore not possible to say which records, if any, left the organisation’s environment. Asserting a specific inventory would repeat the attackers’ marketing without evidence.

If files were taken from a disability or community support provider, organisations in this sector typically hold some combination of the following—presented here only as sector norms, not as a claimed list for this incident:

• Names, addresses, phone numbers, and email addresses of clients and contacts
• Dates of birth, identifiers used for funding or government programmes, and emergency contacts
• Health, disability, medication, or support-need information used to plan care
• Support plans, incident notes, and communications with families or other providers
• Staff HR details, rosters, and internal operational documents
• Billing, invoices, and insurance or scheme-related financial records

Whether any of that was involved here remains unconfirmed. The Anubis listing does not supply a reliable catalogue, and the people-affected figure is unknown.

The real-world impact

If personal information from a support provider were ever published or traded, affected individuals could face phishing that references real services, attempts to take over accounts tied to the same email or phone number, or misuse of identity details for fraud. Health and disability-related data, when exposed, can also mean stigma or unwanted disclosure of private circumstances. Those risks are conditional: they apply if material was actually obtained and if it includes personal records.

For the organisation, an unverified public listing can still disrupt trust, generate support queries, and require careful internal review and external communication—even when the underlying claim is disputed or false. Staff and partner organisations may need clear guidance on what has and has not been established. None of that proves the Anubis narrative; it reflects how extortion listings function in practice.

Because counts, file sets, and confirmation are absent from the public record described here, impact assessments must stay provisional. Treating the leak site as definitive would overstate what is known.

If your data was involved

If you are a client, family member, or employee who worries your information might be tied to this claim, act on a precautionary basis rather than on certainty. Prefer official channels from Gellibrand Support Services or relevant regulators for updates; do not rely on ransomware sites for truth or for “proof” files. Watch for unexpected messages that mention support services, invoices, or personal details you did not initiate. Consider strengthening passwords on email and any portals you use for care or benefits, and enable multi-factor authentication where available. If you see signs of identity misuse, follow local guidance for fraud reporting and credit or identity monitoring as appropriate in your jurisdiction.

You can also run a free exposure scan of your email address to check whether that address has already appeared in other known breach datasets—useful context even when a specific incident remains unconfirmed. Keep expectations realistic: such scans do not prove or disprove the Anubis listing; they only show whether your email is already circulating in indexed collections. Until Gellibrand Support Services or another authoritative source confirms facts, treat involvement as possible rather than established, and prioritise calm, practical steps over the group’s claims.

AICompiled with AI assistance from public sources and published under our editorial standards.