Anubis Ransomware Breached Adriatic Port Authority and Stole Port Security Data

The Anubis ransomware group breached the Adriatic Port Authority, which operates the Italian port of Ancona, in an intrusion that reportedly began with a spear-phishing attack on December 11, 2025 and was publicly attributed after the victim appeared on the gang’s leak site in January 2026. Reporting indicates the attackers moved through the authority’s IT environment rather than operational technology systems and exfiltrated a limited set of data, including employee records and sensitive port security-related documents.

Security researchers said the compromise may have been enabled by weak cloud account protections in Office 365 and Azure, alongside broader exposure to unpatched internet-facing systems commonly exploited by ransomware-as-a-service operators. The incident has been highlighted as a warning for the maritime sector, where aging IT infrastructure and comparatively low cyber maturity continue to leave port authorities vulnerable to disruptive and data-theft-focused attacks.