Skip to main content
Darkfield

Ransomware victim disclosure

← All victims

Gaedke & Partner Steuerberatung GmbH

listed as Gaedke & Partner Steuerberatung · Claimed by Anubis · listed 5 hours ago

Today
Age
since listed · data leaked

Status timeline

  1. ListedSep 22, 2026
  2. Data leakeddate unknown

At a glance

Group
Anubis
Status
Data leaked
Country
Germany
Sector
Professional Services
Listed on leak site
Sep 22, 2026

About the victim

AI dossier — public-source company profile

Gaedke & Partner Steuerberatung GmbH is an Austrian tax consulting firm operating from three locations (Graz, Vienna, Werndorf) that provides bookkeeping, annual financial statements, payroll processing, and tax advisory services to a diverse clientele including employees, startups, SMEs, large corporations, and professionals in healthcare and agriculture sectors.

Industry
Tax Consulting & Accounting Services
Address
Graz, Vienna, and Werndorf, Austria

Attack summary

Severity: high — Confirmed exfiltration of sensitive financial and business data from a professional services firm affecting multiple clients. Tax/accounting data exposes regulated financial information and PII at scale across diverse client base.

The anubis group claims to have exfiltrated sensitive client data from Gaedke & Partner Steuerberatung GmbH. The disclosed information includes financial records and business operation documents belonging to the firm's clients across multiple industries.

high

Data the group says was taken

AI dossier — extracted from the leak post
  • Financial records
  • Client business documents
  • Bookkeeping data
  • Annual financial statements
  • Payroll processing information

What the group claims

Data breach exposes accounting firm's client data.

The leak post

captured from the group's site
"[Gaedke & Partner Steuerberatung GmbH](http://anubisyfkh5rixydjpoo3jqucauajz2juybrbtuglcppjj2y3eg3y6ad.onion/r/www.gaedke.co.at) offers comprehensive tax consulting services, including bookkeeping, annual financial statements, and payroll processing, from their locations in Graz, Vienna, and Werndorf. They cater to a diverse clientele, including employees, startups, SMEs, large corporations, and professionals in various fields such as healthcare and agriculture.""
Well, here we have another accounting firm, unfortunately with virtually the exact same type of data we saw in the previous case.
What does this tell us? Apparently, even educated professionals whose work requires exceptional attention to detail don't necessarily carry that same attention over to other areas of their own business. And the result is yet another data leak exposing sensitive information belonging to the firm's clients, ranging from financial records to other documents required for various business operations and processes.
If people often see notaries, lawyers, and real estate agents as parasites sucking money out of thin air, accountants still mostly have a good reputation as people who can help you save b…

Sources

Source

Indexed 5 hours ago

This page surfaces a public ransomware disclosure indexed by Darkfield. Original posts come from the operator's own leak site; we cross-check against ransomware.live, RansomLook and RansomWatch where applicable. Share this URL freely.

Is this your supplier? Your competitor? You?

Pro plans monitor your domain, corporate emails, and crypto wallets across every new ransomware leak-site post, breach dump and Telegram callout — alerts within 5 minutes.

Disclosure context

About anubis

Anubis is a recently emerged ransomware group that began operations in February 2025, primarily motivated by financial gain through encryption and extortion attacks. The group has demonstrated rapid expansion, accumulating 65 documented victims within a short operational timeframe. Given the group's recent emergence, limited information is publicly available regarding their specific country of origin, organizational structure, or confirmed affiliations with other cybercriminal entities, though their operational patterns suggest they may operate as an independent group or small-scale ransomware-as-a-service operation. Their attack methodology appears to focus on opportunistic targeting across multiple geographic regions, with victims concentrated primarily in the United States, Australia, Canada, the United Kingdom, and France, indicating either English-language proficiency or the use of automated tools that facilitate cross-border operations. The group demonstrates a clear preference for targeting healthcare organizations and manufacturing companies, followed by business services and technology sectors, suggesting they prioritize organizations with critical operational dependencies that may be more likely to pay ransoms quickly. Due to the group's recent emergence in early 2025, there is insufficient publicly documented information from established cybersecurity firms or law enforcement agencies regarding their specific technical capabilities, encryption methods, or whether they employ double or triple extortion tactics involving data theft and leak sites. As of current reporting, Anubis remains an active threat with continued victim acquisition, though the full scope of their capabilities and long-term operational sustainability remains to be determined as security researchers continue to analyze their activities. The group has been linked to 115 public disclosures across our corpus. First observed on a leak site on February 25, 2025; most recent post September 22, 2026. The operation is currently active.

Timeline of this disclosure

  • September 22, 2026Gaedke & Partner Steuerberatung listed by anubis on the group's public leak site

Other recent disclosures by anubis

anubis has been linked to 115 public victims on Darkfield. A sample of the most recent:

See the full anubis dossier →

Sector and geography

This disclosure adds to ransomware activity in the Professional Services sector, which has 17 disclosures indexed across all operators we track. Geographically, Gaedke & Partner Steuerberatung is reported in Germany, a country with 393 ransomware disclosures in our corpus.

If your organisation is affected

A listing by anubis means Gaedke & Partner Steuerberatung appeared on a ransomware extortion site and data attributed to it has been published. If this is your organisation, or a supplier you depend on, the priority is to confirm the intrusion and contain it before the window to act closes.

  • Engage your incident-response team and preserve forensic evidence before remediating — do not wipe affected systems first.
  • Force a password reset and revoke active sessions for exposed accounts; rotate any credentials, API keys or certificates that may have been in the stolen data.
  • Assess regulatory notification duties (GDPR, NIS2, sector regulators) — many carry a 72-hour reporting clock from awareness.
  • Report the incident to your national CERT, CERT-Bund (Germany), as required for your jurisdiction.
  • Monitor for the data appearing on anubis's leak site and across paste and breach channels, and brief downstream partners who may be exposed through you.

How we know this. Darkfield monitors public ransomware leak sites continuously, archiving every new disclosure and the data later released against the victim. Each entry on this page is sourced from the operator's own publication and cross-checked against complementary OSINT feeds (RansomLook, ransomware.live, RansomWatch). We do not collect or host stolen data — only the metadata, timestamps and screenshots needed to make the public disclosure searchable and accountable. Records here are corrected when the original post is edited, retracted, or merged with another disclosure.