Paint maker giant AkzoNobel confirms cyberattack on U.S. site
Source: Bleeping Computer
AkzoNobel, the multinational Dutch paint company, has confirmed to BleepingComputer that hackers breached the network of one of its U.S. sites. The intrusion has been contained and the impact is limited.
“AkzoNobel has identified a security incident at one of our sites in the United States. The incident was limited to the respective site and was already contained,” the company told BleepingComputer.
“The impact is limited, and we are taking the appropriate steps to notify and support impacted parties, and will work closely with relevant authorities.”
Company background
AkzoNobel is a major paints and coatings company with 35,000 employees, annual revenue exceeding $12 billion, and operations in over 150 countries. Brands under its corporate umbrella include Dulux, Sikkens, International, and Interpon.
Data leak details
The Anubis ransomware gang claims to have stolen 170 GB of data (approximately 170,000 files) from AkzoNobel and leaked samples on its leak site, including screenshots of select documents and a list of the stolen files.
AkzoNobel entry on the Anubis ransomware site
Source: BleepingComputer
The published data contains:
- Confidential agreements with high‑profile clients
- Email addresses and phone numbers
- Private email correspondence
- Passport scans
- Material testing documents
- Internal technical specification sheets
At the time of writing, the Anubis leak is only partial. AkzoNobel has not disclosed whether it engaged with the threat actor.
About the Anubis ransomware
Anubis is a ransomware‑as‑a‑service (RaaS) operation that launched in December 2024, offering affiliates 80 % of the paid ransoms (source).
- February 2025: Operators launched an affiliate program on the RAMP forum, boosting activity and influence in the cybercrime space.
- June 2025: Anubis added a data wiper that destroys victim files to make recovery impossible (details).