Grand Rapids Controls Listed by anubis Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Grand Rapids Controls has been listed by the anubis ransomware group as a victim of a data breach, according to a report dated August 15, 2025. Public details indicate that the group claims to have exfiltrated internal files in a ransomware attack, with a reported 150 GB leak said to include confidential documents and NDA agreements involving companies such as Ford, Bentley, Lear, and others. The number of people affected remains unknown, and independent confirmation of the full scope is limited at this stage.

This matters because Grand Rapids Controls operates in a sector that handles sensitive commercial and operational information. Any confirmed exposure of such material can create lasting risks for the organisation, its partners, and individuals whose data may be involved, even when exact counts and methods stay undisclosed.

Inside the incident

The available facts state that Grand Rapids Controls was listed by the anubis ransomware group on or around August 15, 2025. The listing describes a ransomware attack in which internal files were allegedly exfiltrated. The group claims the volume of data involved is 150 GB and that it consists of confidential documents and NDA agreements with companies including Ford, Bentley, Lear, and others. No further public detail has been provided on the precise timing of the intrusion, the initial access method, the encryption status of systems, or any ransom demand. The number of individuals affected is listed as unknown. At present the listing itself remains an unverified claim by the group; no independent confirmation of successful data publication or full contents has been included in the reported summary.

Inside anubis

Anubis is a ransomware operation that has appeared in public threat reporting as a group that practices double extortion. In typical cases the group claims to encrypt systems and simultaneously steal data, then threatens to publish the material on a dedicated leak site if payment is not made. Publicly documented activity by anubis has included listings of organisations across manufacturing, logistics, and professional services, often accompanied by sample file screenshots or volume claims. The group’s leak-site posts are treated by researchers as assertions rather than Reported Facts until independent evidence appears. In this instance the facts record only that anubis listed Grand Rapids Controls and described a 150 GB set of internal files; no additional statements attributed specifically to this victim beyond that claim are present in the reported information.

Grand Rapids Controls and its sector

Grand Rapids Controls is an organisation whose name and the companies named in the claimed leak—Ford, Bentley, Lear—place it in the automotive supply and controls manufacturing sector. Firms of this type commonly design, produce, or integrate electronic, mechanical, or electromechanical components used in vehicle systems. They routinely hold engineering drawings, supplier contracts, non-disclosure agreements, quality-control records, and correspondence with original-equipment manufacturers. A breach involving such an organisation is consequential because the automotive supply chain depends on tightly controlled intellectual property and commercial confidentiality. Exposure can affect not only the direct victim but also tier-one and tier-two partners who share designs and production schedules under NDA.

The information in question

The facts name the exposed material as internal files exfiltrated in a ransomware attack. The reported summary states that the 150 GB leak involves confidential documents and NDA agreements with companies such as Ford, Bentley, Lear, and others. No additional data types—such as employee records, customer personal information, financial ledgers, or source code—are listed as confirmed. Organisations in this sector typically maintain engineering files, commercial contracts, supplier pricing, and personnel data; however, the exact contents of the claimed archive remain unconfirmed beyond the description given by the listing. Public detail is therefore limited to the group’s assertion of confidential documents and NDAs.

What's at stake

For individuals whose information may appear in the files, the primary risks include potential misuse of any personal details that happen to be present, such as names, contact information, or employment-related records. Even when personal data is not the main target, secondary exposure can still occur if documents contain signatures, addresses, or identification numbers. For Grand Rapids Controls the stakes centre on commercial confidentiality: release of NDAs and internal documents could reveal pricing, technical specifications, or partnership terms to competitors or other third parties. Partners named in the claimed material—Ford, Bentley, Lear, and others—may face their own contractual or reputational considerations if proprietary information is confirmed to have left the organisation. Operational disruption from any encryption component of the attack, though not detailed in the facts, can also delay production schedules in a just-in-time manufacturing environment. Recovery costs, legal notifications, and long-term trust erosion remain possible consequences regardless of whether a ransom is paid.

Were you affected?

If you have a current or past relationship with Grand Rapids Controls—as an employee, contractor, or partner—monitor official statements from the company for any notification of personal data involvement. Change passwords on accounts that may have been used in connection with the organisation, enable multi-factor authentication where available, and watch financial and credit activity for unusual behaviour. Because the number of people affected is unknown and the precise data types remain limited to the group’s claim of internal files and NDAs, treat any unsolicited contact that references the incident with caution. Readers can also run a free exposure scan of their email address to check whether that address has already appeared in known breach data sets elsewhere.

AICompiled with AI assistance from public sources and published under our editorial standards.