Notifications
Clear all
Topic starter
09/07/2026 3:27 pm
TL;DR: ANUBIS ransomware attackers claimed a breach at Grand Rapids Controls and exposed engineering specifications, financial records, NDAs, directory structures, and employee data, according to Gurucul. The incident shows how broad file access and weak segmentation can turn one compromise into operational, legal, and fraud risk.
NHIMG editorial — based on content published by Gurucul covering the Grand Rapids Controls ransomware breach: Threat Intelligence Grand Rapids Controls (GRC)
Questions worth separating out
Q: What breaks when shared file access is too broad in a ransomware incident?
A: Broad file access turns a single compromise into multi-domain exposure.
Q: Why do directory structures matter to IAM and security teams?
A: Directory structures reveal how access is organised and where sensitive information is concentrated.
Q: How can organisations reduce the impact of data theft after a ransomware breach?
A: Reduce the amount of sensitive data any one account can reach, especially across business functions.
Practitioner guidance
- Tighten folder-level entitlement boundaries Review shared drives, document repositories, and collaboration spaces so Engineering, Finance, HR, and Legal data are separated by explicit access groups rather than inherited broad permissions.
- Map cross-domain read access Inventory which accounts can read multiple business functions and remove any entitlement that lets one user or service account traverse unrelated sensitive datasets.
- Revalidate directory structures against business need Treat directory trees as governance objects and recertify them the same way you recertify application access, especially where internal folders reveal operating structure.
What's in the full article
Gurucul's full article covers the operational detail this post intentionally leaves for the source:
- The specific leaked data samples and how each category increases operational, legal, or fraud exposure.
- The article's own recommended control stack for reducing ransomware impact across user and system access.
- The incident context around the ANUBIS leak claim and how the exposure may affect affected stakeholders.
- The full list of prevention recommendations, including monitoring, segmentation, and incident response measures.
👉 Read Gurucul's analysis of the Grand Rapids Controls ransomware breach →
Grand Rapids Controls data leak: what manufacturing IAM teams should notice?
Explore further
09/07/2026 3:47 pm
Directory sprawl is now an identity control problem, not a storage problem. Once attackers can see how Engineering, Finance, HR, and Legal content is organised, the file system becomes a map of entitlement weakness. That means the governance failure sits in how access was structured before the breach, not only in what the attacker stole. Practitioners should treat folder hierarchy as a control surface, not a convenience layer.
A few things that frame the scale:
- 72% of organisations have experienced or suspect they have experienced a breach of non-human identities, according to The 2024 ESG Report: Managing Non-Human Identities.
- Enterprises that have experienced a compromised NHI averaged 2.7 separate incidents in the past 12 months, according to the same report.
A question worth separating out:
Q: Who is accountable when broad file permissions enable a ransomware leak?
A: Accountability sits with the teams responsible for identity governance, data access design, and repository ownership. If permissions were never scoped to business need, or if recertification did not remove cross-functional access, the breach is a governance failure as much as a security event. Compliance, IAM, and data owners all need a shared view of access scope.
👉 Read our full editorial: Grand Rapids Controls ransomware breach exposes sensitive operational data
