Nachlass Nord Listed by anubis Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On June 25, 2026, the ransomware group anubis listed Nachlass Nord on its leak site, stating that internal files had been exfiltrated during a ransomware attack. The number of individuals affected is not known, and no further technical details about the intrusion have been made public. This listing fits a pattern seen across multiple sectors in which operators publish victim names to increase leverage during ransom negotiations.

Inside the incident

The only confirmed information is the June 25, 2026 listing and the claim that internal files were removed. No data volume, file count, encryption status, or ransom demand has been disclosed. The organization has not issued a public statement confirming or denying the claims.

Inside anubis

Anubis is a ransomware operator that follows the double-extortion model common among current groups: data is copied before encryption, and the threat of publication is used to compel payment. The group maintains a leak site where it lists organizations it claims to have compromised. Such listings are presented by the operator as evidence of access but remain unverified until independently confirmed by the victim or investigators.

Who is Nachlass Nord?

Nachlass Nord operates as a firm of inheritance lawyers. Organizations in this sector routinely collect and store identification documents, wills, property records, family relationships, and financial details required to settle estates. Because these records often contain information that cannot be changed, such as dates of birth, national identification numbers, and kinship data, a compromise carries lasting implications for the individuals named in the files.

What was likely exposed

The listing refers only to “internal files exfiltrated in ransomware attack.” The reported summary of the incident mentions IDs, estate records, and client data, but the precise contents of the exfiltrated material have not been confirmed or published.

Why it matters

Records held by inheritance lawyers frequently include data that remains sensitive for decades. Unauthorized disclosure can facilitate identity misuse, targeted fraud, or unwanted revelation of family and financial arrangements. For the organization, the incident adds operational disruption and potential regulatory obligations under data-protection rules that apply to legal-service providers.

If your data was in this claimed breach

Because the exact records involved are not public, individuals cannot yet determine their personal exposure from official sources alone. Practical first steps include:

• Reviewing recent account statements and credit reports for unusual activity.
• Enabling multi-factor authentication on any services that hold personal identifiers.
• Running a free exposure scan of your email address against known breach datasets to check for prior appearances of the same information.

Further updates from Nachlass Nord or regulatory notices may provide additional clarity on the scope of the data involved.

AICompiled with AI assistance from public sources and published under our editorial standards.