Loading story…
AkzoNobel, one of the world’s largest paint manufacturers, disclosed a cyberattack affecting operations at a U.S. site and later confirmed that the incident also involved a data breach. The company said it detected unauthorized activity in its environment and took affected systems offline as part of its response, while working to contain the intrusion and assess the impact on business operations.
Public reporting indicates the incident was limited to a U.S. location rather than the company’s broader global network, though AkzoNobel has not released detailed technical indicators or attributed the attack to a specific threat actor. The company said its investigation was ongoing, with external cybersecurity specialists engaged to determine what data was accessed and to support remediation and recovery efforts.
See attribution, scope, and your downstream exposure.
2 events from the most recent confirmed update back to the earliest known activity.
Subsequent reporting described the incident as a data breach involving AkzoNobel's U.S. site. This reflected a public disclosure that data exposure was part of the impact of the previously confirmed cyberattack.
AkzoNobel confirmed that it experienced a cyberattack impacting one of its U.S. locations. The company said it took affected systems offline and began investigating the incident.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
French industrial supplier **LISI Group** confirmed a cybersecurity incident affecting two ancillary sites after the **Qilin** ransomware gang claimed responsibility. The company said only a limited amount of information was stolen and that core operations and infrastructure were not impacted; however, data samples attributed to Qilin reportedly included internal business documents and sensitive records such as bank-transfer screenshots, bank account details, employee forms, contracts, and partner-related documentation. Dutch paints and coatings firm **AkzoNobel** also confirmed a contained intrusion limited to a single U.S. site following a leak attributed to the **Anubis** ransomware operation. Anubis claimed theft of roughly **170GB** (nearly **170,000 files**) and published partial leak samples allegedly including confidential client agreements, internal correspondence, passport scans, material testing documents, and technical specification sheets; AkzoNobel stated it is notifying impacted parties and coordinating with authorities. Separately, a BlackFog monthly ransomware roundup reported **82** publicly disclosed ransomware incidents in February 2026 (healthcare most targeted) and highlighted other claimed/extortion cases (e.g., **Everest** claims involving Hosokawa Micron and Iron Mountain), but it did not provide additional corroboration on the LISI Group or AkzoNobel incidents.
Jun 29, 2026
Dutch paint manufacturer **AkzoNobel** confirmed a network breach at one of its U.S. sites, with the **Anubis** ransomware operation claiming responsibility and alleging theft of ~**170GB** (about **170,000 files**) of data. Reported stolen materials include confidential client agreements, employee contact details, private emails, passport scans, and technical documents; AkzoNobel said the incident was contained and impact was limited, and it did not disclose whether negotiations are underway. Reporting also noted Anubis’ evolution as a **ransomware-as-a-service (RaaS)** operation and prior use of a **data-wiper** capability intended to destroy files beyond recovery. Separately, the **University of Mississippi Medical Center (UMMC)** reported it restored normal clinic operations after a ransomware attack disrupted electronic medical records, phone lines, and multiple IT systems for nine days; no group had publicly claimed the intrusion, though officials said they were in contact with the attackers and working with authorities and specialists. Additional context on the broader ransomware landscape included a February tally of publicly disclosed incidents across sectors and geographies, and technical reporting showing how a successful brute-force login against exposed **RDP** can lead to domain enumeration, credential-hunting, and identification of geo-distributed infrastructure tied to a **RaaS ecosystem** and **initial access brokers**—highlighting continued risk from internet-exposed remote access services and credential-based intrusion paths.
Jun 29, 2026
Accenture confirmed a cybersecurity breach after a threat actor using the name **"888"** advertised roughly **35 GB** of alleged company data for sale on a cybercrime forum. The seller claimed the cache included source code, configuration files, **RSA keys**, **SSH keys**, **Azure Personal Access Tokens**, and **Azure Storage access keys**, and reportedly shared a screenshot appearing to show an Azure DevOps repository tied to an Accenture domain being cloned. Independent verification of the full dataset and its authenticity was not available at the time of reporting. Accenture said it detected irregular activity, investigated the incident, contained the affected environment, remediated the source of the breach, and restored impacted systems. The company said operations and service delivery were not affected, but it has not disclosed how the intrusion occurred, how many systems or repositories were involved, whether the exposed credentials were valid, or whether any customer data or customer environments were impacted.
Jul 11, 2026