They’ve escaped a lot of media attention, but Anubis RaaS is a threat to the medical sector

Anubis RaaS is described as encrypting systems and exfiltrating data, despite not receiving much media attention, with a recent claim of attacking Mid South Pulmonary & Sleep Specialists (MSPS) in Tennessee. According to SuspectFile, initial access to MSPS occurred on 10 November 2025, after which Anubis allegedly spent about a week studying the network and planning the operation before striking and paralyzing the organisation.

The group is said to have encrypted all of MSPS’s Nutanix systems and exfiltrated 860 GB of information, with 300 GB leaked so far and claims to have sold other data. The file tree reviewed by SuspectFile reportedly includes administrative records, hundreds of billing documents to insurers, and documents containing PII and PHI such as names, dates of birth, and SSNs.

DataBreaches[.]Net notes that Anubis has listings for five U.S. healthcare entities on its darkweb leak site, all added in November, with only one entity having sent notification letters so far.