www.anubis-cosmetics.com Listed by kraken Ransomware Group: Ransomware Claim — What’s Alleged & What To Do
www.anubis-cosmetics.com has been listed by the kraken ransomware group, with internal files reported as exfiltrated; the listing was disclosed on 2 April 2025. Anyone who has used the site is urged to check their accounts and monitor for any suspicious activity.
Ransomware groups continue to list organisations of every size on dark-web leak sites, turning stolen data into leverage and public pressure. In this environment, even companies outside critical infrastructure can find themselves named as victims, with limited independent verification available at the outset.
On 2 April 2025, the website www.anubis-cosmetics.com was listed by the ransomware group known as kraken. The listing identifies the organisation as ANUBIS COSMETICS, S.L. and asserts that internal files were exfiltrated in a ransomware attack. The number of people affected remains unknown, and public detail on the precise scope is limited. The claim matters because any confirmed exposure of internal material can create lasting operational, legal and personal risks for a cosmetics business and those connected to it.
Breaking down the breach
According to the available record, www.anubis-cosmetics.com appeared on a kraken-associated leak site on 2 April 2025. The group claims that internal files belonging to ANUBIS COSMETICS, S.L. were taken during a ransomware attack. No figure for the volume of data, no list of specific file categories beyond the general description “internal files,” and no confirmed date of initial intrusion have been published in the source material. The number of individuals potentially affected is listed as unknown. Independent confirmation of the group’s assertions has not been supplied in the facts available, so the listing itself stands as an unverified claim by the threat actor.
Public reporting does not describe the initial access method, the encryption status of systems, or any ransom demand. In the absence of those details, the only concrete elements that can be stated are the date of the listing, the named organisation, and the assertion that internal files were exfiltrated.
Who is kraken?
Kraken is a ransomware operation that has appeared in public threat reporting as a group that both encrypts systems and exfiltrates data before posting victims on dedicated leak sites. Like many contemporary ransomware crews, it typically seeks to pressure organisations by threatening to publish stolen material if demands are not met. Public analyses describe the group as operating with a double-extortion model common among ransomware actors: data theft combined with encryption, followed by timed releases or full dumps on dark-web portals.
Prior activity attributed to kraken in open sources has involved a range of commercial and industrial targets rather than a single sector focus. The group’s leak-site posts are claims of compromise; they do not by themselves constitute forensic proof. In this case, the listing of www.anubis-cosmetics.com should be read as the group asserting that it holds internal files from ANUBIS COSMETICS, S.L., not as independently verified fact.
About www.anubis-cosmetics.com
www.anubis-cosmetics.com is the online presence of ANUBIS COSMETICS, S.L., a company operating in the cosmetics sector. Businesses of this type typically develop, manufacture or distribute personal-care products and therefore maintain records that can include supplier contracts, formulation data, customer orders, employee information, and marketing or sales databases. Even when a company is modest in size, such material can be commercially sensitive and personally identifiable.
A breach claim against a cosmetics firm is consequential because the sector handles both proprietary product information and consumer-facing data. Loss or public release of internal files can disrupt supply chains, expose competitive details, and create compliance obligations under data-protection rules that apply to any organisation processing personal information of customers or staff.
What data was at risk
The facts state only that “internal files” were exfiltrated in a ransomware attack. No further breakdown—such as customer lists, financial records, employee files, or product formulas—has been disclosed. Organisations in the cosmetics industry commonly hold customer contact details, order histories, employee personnel records, supplier agreements, and research or manufacturing documentation. Whether any of those categories were among the files claimed by kraken remains unconfirmed. Readers should treat the precise contents as unknown until additional verified information appears.
What's at stake
For individuals whose data may have been included, the practical risks include phishing or social-engineering attempts that reference genuine company details, potential identity misuse if personal identifiers were present, and longer-term exposure if the material is later sold or recirculated. For the organisation itself, the stakes include operational disruption, possible regulatory notification duties, reputational damage among customers and partners, and the cost of investigation and remediation. Because the scale of the incident and the exact data types remain undisclosed, the full extent of these risks cannot yet be quantified.
What to do if you're exposed
If you have done business with or worked for ANUBIS COSMETICS, S.L., treat the listing as a reason for caution rather than confirmed personal compromise. Practical first steps include:
- Monitor bank and card statements for unfamiliar activity and enable transaction alerts where available.
- Be sceptical of unexpected emails, calls or messages that claim to come from the company or reference the incident; verify through official channels you already trust.
- Change passwords for any accounts that reused credentials associated with the company, and enable multi-factor authentication wherever possible.
- Consider placing a fraud alert or credit freeze with major credit bureaus if you believe sensitive personal identifiers could have been involved.
- Keep records of any suspicious contact so you can report it to local authorities or consumer-protection agencies if needed.
You can also run a free exposure scan of your email address to check whether it has already appeared in known breach data sets. That check will not confirm or deny involvement in this specific incident, but it can surface other exposures that warrant the same protective measures.
AICompiled with AI assistance from public sources and published under our editorial standards.
How this breach connects
More recent breaches
www.ultrarapit.net Listed by kraken Ransomware Groupwww.sanmarti.es Listed by kraken Ransomware GroupKitty cookies Listed by kraken Ransomware Groupwww.pointcag.com Listed by kraken Ransomware GroupLatest breaches
Publicly posted by kraken — unverified claim, pending independent verification
Breach listings — particularly those originating from ransomware or leak sites — are third-party claims that may be unverified, incomplete, or inaccurate. A listing does not by itself confirm that a breach occurred or that any specific data was exposed. Severity is an automated assessment, not a definitive rating. Verification status is shown where available.
Attributions to threat groups and methods reflect public reporting and, in some cases, unverified claims made by the groups themselves; they may be incomplete or later revised. Recent Breaches and GalaxyWarden are independent and are not affiliated with, and do not endorse, any company or group named on this page. This information is aggregated from public sources for awareness only and is not legal, security, or investment advice.