Anubis Ransomware Group Strikes New Zealand Law Firm, Exposing Sensitive Client Data In January 2026, Napier-based law firm Langley Twigg fell victim to a cyberattack by the Anubis ransomware group, a Russian-linked ransomware-as-a-service (RaaS) operation first detected in February 2025. The group, known for its aggressive multi-extortion tactics, breached the firm’s systems on January 11, exfiltrating internal records, client documents, and sensitive personal data including employee and client passport scans, financial reports, and property transaction files. Langley Twigg detected the intrusion through security monitoring tools and immediately took its network offline, engaging digital forensics specialists to contain the breach. While the firm confirmed that data was accessed and copied, the full scope of the exposure remains under investigation. The compromised materials later published on Anubis’s darknet leak site include identity documents, settlement statements, and regulatory records, raising concerns about potential identity theft and fraud for affected individuals. Unlike traditional ransomware attacks that rely solely on file encryption, Anubis employs a multi-extortion strategy, combining data theft with reputational pressure and regulatory threats. The group has previously targeted healthcare and professional services sectors, including a Queensland medical clinic in December 2025, and is known for contacting third parties, such as journalists, to amplify the impact of its leaks. Langley Twigg has notified New Zealand’s Office of the Privacy Commissioner and Police, both of which are investigating the incident. The firm is working to identify affected clients and assess legal obligations under privacy breach regulations. Meanwhile, the New Zealand Law Society has reinforced cybersecurity guidance for legal practices, emphasizing multi-factor authentication, staff training, and secure backups in response to rising threats. The attack underscores the growing risk to small and medium-sized enterprises (SMEs), which often lack dedicated cybersecurity teams. Netsafe’s chief online safety officer, Sean Lyons, noted that while some breaches are targeted, others exploit known vulnerabilities in broader campaigns. The incident follows another major breach at ManageMyHealth, a patient portal, highlighting persistent cyber risks for organizations handling financial, identity, and health data. As investigations continue, the Anubis breach serves as a reminder of the financial, regulatory, and reputational consequences of ransomware attacks, particularly for firms managing sensitive client information.

Langley Twigg Law Hit by Anubis Ransomware Attack, Client and Employee Data Exposed A New Zealand-based law firm, Langley Twigg Law in Napier, is investigating a cybersecurity breach after the Anubis ransomware group claimed responsibility for a malicious attack that compromised a portion of its data. The incident was first detected on 11 January 2026, when the firm’s security monitoring software flagged unauthorized activity on its network. In response, Langley Twigg disconnected its systems from the internet and engaged IT support and digital forensics experts to contain the breach. While the firm had cybersecurity protections in place, the attack employed a novel method, allowing threat actors to access and exfiltrate data before systems were restored from backups. The compromised data includes internal operational documents and client files, though the full extent remains under investigation. The firm has notified New Zealand’s Office of the Privacy Commissioner and the police, and is working with cyber incident response specialists to identify affected individuals. Once the review is complete, Langley Twigg plans to contact impacted clients directly. On 25 January 2026, Anubis posted details of the attack on its darknet leak site, claiming to have stolen financial records, employee compensation data, passport scans, and client documents, including property transaction records and settlement statements. The leaked materials appear legitimate, with some files bearing the firm’s letterhead. Anubis also published passport details of employees and clients, escalating the risk of identity theft and regulatory exposure. Anubis, a Russian-speaking ransomware-as-a-service (RaaS) group, emerged in February 2025 and has since targeted 46 organizations worldwide. Known for detailed leak posts, the group pressures victims by exposing sensitive data and threatening regulatory consequences. Its tactics include posing as journalists to further coerce targets. Langley Twigg is the latest in a string of ANZ region victims, following a December 2025 attack on Queensland’s Laidley Family Doctors.