On August 3, 2026, the Anubis ransomware-as-a-service operation named U.S. grocery retailer Winn-Dixie on its dark web leak site, threatening to publish stolen data unless ransom demands are met. The claim was picked up by DeXpose, which recorded the victim domain as winndixie.com and quoted the actor's own boast, "Inside a multibillion-dollar retail giant." As of publication, every available account of this incident traces back to the attacker's post or to trackers that scrape it. Winn-Dixie and parent company Southeastern Grocers have not confirmed a breach, no regulator filing has surfaced, no affected-individual count has been released, and no data has been observed published. Readers should treat this as an unverified extortion claim from a group with a documented history of following through.
What Happened
The core of the incident is a single leak site listing. Class Action U reports that the claim first appeared via the dark web monitoring platform Ransomware.live on August 3, 2026, with the intrusion estimated to have occurred that same day, and that the outlet HookPhish independently attributed the claimed attack to Anubis. Undercode News, citing the ThreatMon Threat Intelligence Team, separately confirms that Anubis added Winn-Dixie to its victim list on the same day, alongside an unrelated GlobalSecretGroup listing for Novum Energy. Multiple trackers, in other words, saw the same post rather than corroborating the underlying attack.
Accounts differ on how much is actually established. Class Action U labels the August 3 breach date "alleged" and "unconfirmed" and states plainly that no scope, cause, or affected-individual count has been released. Rankiteo's blog post characterises Winn-Dixie as "under investigation," but that framing appears to describe the plaintiff-side legal investigation launched by ClassAction.org rather than an incident response effort by the company; Rankiteo cites the ClassAction.org page as its sole source and notes that no formal breach disclosure or official company response has been reported. Rankiteo's own structured record assigns the event a severity of 85 and an impact of 4 with the explanation "attack with significant impact with customers data leaks," but that scoring is a vendor risk-rating artifact, not a finding backed by evidence in any of the available reporting.
The plaintiffs' bar moved within hours. ClassAction.org opened an intake for anyone "affiliated with Winn-Dixie" who suspects exposure, and Class Action U published a parallel solicitation covering employees, customers, and vendors. Winn-Dixie operates under Southeastern Grocers and serves Florida, Georgia, Alabama, Louisiana, and Mississippi, giving any eventual notification obligation a five-state footprint.
What Was Taken
Nothing has been substantiated. No source in this set reports a record count, a data volume, a sample set, or a category of stolen information. Class Action U lists impacted data as "not yet publicly disclosed." Rankiteo's structured entry records only a generic "personal information" sensitivity tag, which is an inference from the victim's sector rather than an observation of leaked files. Undercode News acknowledges that full technical details remain limited.
What is knowable is what a grocery chain of this size holds, and Undercode News frames the target profile accordingly: large store networks, payment systems, customer records, employee files, and supply chain connections. That is a risk envelope, not an inventory of loss. Any figure circulating for this incident at this stage should be treated as unsourced until Winn-Dixie, a state attorney general filing, or a published leak establishes it.
Why It Matters
Anubis is not a low-consequence actor. UltraViolet Cyber's July 29, 2026 threat advisory describes a RaaS operation active since December 2024, originally tested under the name "Sphinx," now running an affiliate program on Russian-language forums with negotiable revenue splits and separate monetization tracks for pure data extortion and for access sales. Critically, its encryptor ships with an optional file-wiping capability, which means recovery from backups can be defeated by permanent destruction rather than mere encryption.
The group's track record supports taking the claim seriously. UltraViolet Cyber documents that Anubis claimed an attack on Coca-Cola's Fairlife dairy subsidiary in July 2026, alleged roughly 1 TB of stolen data, and published that data when the ransom deadline passed. That incident disrupted U.S. dairy production, triggered an SEC disclosure, and ended in confirmed data theft. Tech Times, summarising Arctic Wolf Labs research published July 1, 2026, counted 91 Anubis victims in roughly 19 months of operation, including 11 in June 2026 alone, spanning healthcare, financial services, manufacturing, and technology, with more than half based in the U.S. and the remainder concentrated in the United Kingdom, Australia, France, and Canada. UltraViolet Cyber reads the same victimology as opportunistic rather than sector-targeted, meaning no industry should assume it is off the list.
For defenders, the practical significance of a listing like this is the window it opens. As Class Action U notes, ransomware crews routinely publish claims before, or instead of, any company confirmation, leaving days or weeks in which scope is unknown. Suppliers, payment partners, and franchise operators connected to Winn-Dixie are effectively operating blind during that gap, and the Fairlife case shows how a single business unit can become the entry point for enterprise-wide consequences.
The Attack Technique
No initial access vector has been reported for the Winn-Dixie claim specifically. What follows is Anubis tradecraft documented elsewhere, offered as a hunting baseline rather than an account of this intrusion.
Arctic Wolf Labs, as reported by Tech Times, ties Anubis intrusions to CVE-2025-5777, the pre-authentication memory disclosure flaw in Citrix NetScaler ADC and Gateway dubbed "Citrix Bleed 2" after the 2023 CVE-2023-4966 campaign. The bug leaks session tokens without any password, which means MFA is bypassed rather than defeated. It is exploitable only when the appliance is configured as a Gateway, covering VPN virtual server, ICA Proxy, CVPN, or RDP Proxy modes, or as an AAA virtual server; default configurations are unaffected. The exposure was still substantial: Censys documented 69,237 exposed instances at disclosure in June 2025, and Imperva recorded more than 11.5 million attack attempts against the flaw, with 39.1% aimed at financial services. The patching trap is the important part. Tokens harvested before the patch was applied stay valid until they are explicitly revoked, so organizations that patched and closed the ticket may still be exposed.
Post-intrusion, Arctic Wolf found the same pattern in every observed case: legitimate commercial remote monitoring and management software used as the persistence layer, specifically ScreenConnect, Zoho Assist, MeshAgent, Remotely, UltraVNC, and Total Software Deployment. No antivirus signature flags a valid ScreenConnect installer, which is precisely the point. Arctic Wolf's research also implicates Cloudflare's cloudflared tunneling client in the group's toolkit. UltraViolet Cyber's advisory adds spear-phishing as the group's primary initial access method and flags privilege escalation activity as a key detection opportunity, a slightly different emphasis than the Citrix-centric picture from Arctic Wolf. Both are likely true for a RaaS operation where affiliates choose their own way in.
What Organizations Should Do
- Audit and revoke NetScaler sessions, not just patches. Confirm CVE-2025-5777 remediation on every Citrix NetScaler ADC and Gateway appliance, then explicitly terminate all existing sessions. Per Tech Times' account of the Arctic Wolf findings, tokens stolen pre-patch survive patching until revoked. Prioritize appliances configured as VPN, ICA Proxy, CVPN, RDP Proxy, or AAA virtual servers.
- Hunt for unauthorized RMM software. Inventory endpoints for ScreenConnect, Zoho Assist, MeshAgent, Remotely, UltraVNC, and Total Software Deployment, and alert on any instance outside your approved IT baseline. Treat cloudflared tunnels on servers as suspicious by default. These are signed, legitimate binaries; detection has to be policy-driven, not signature-driven.
- Make backups immutable and offline. UltraViolet Cyber is explicit that Anubis's wiper can permanently destroy files, so conventional backups are not sufficient. Verify restoration from offline, immutable copies rather than assuming it works.
- Harden the phishing path and monitor privilege escalation. With spear-phishing identified as a primary entry point, enforce MFA everywhere, tighten email and web filtering, and instrument alerting on anomalous privilege escalation and new admin account creation.
- Check third-party exposure now, before confirmation arrives. If your organization is a Winn-Dixie or Southeastern Grocers supplier, payment partner, or franchise operator, review shared credentials, VPN access, and API integrations during the disclosure gap rather than waiting for a notification that may take weeks.
- Prepare the disclosure and legal track in parallel. Plaintiff firms opened intake within hours of the leak site post, before any confirmed breach. Any organization in this position should engage incident response, counsel, and ransom negotiation specialists before any contact with the actor, and should assume that regulatory notification timelines in affected states are already running.
Sources: Anubis Ransomware Attack on Winn-Dixie - DeXpose | Winn-Dixie Data Breach? Lawyers Assessing Hackers' Claims | Winn-Dixie Data Breach Lawsuit - Class Action U | Winn-Dixie: Winn-DixieData Breach? | From CitrixBleed 2 to Cloudflared: The Tools and Techniques Behind... | Threat Advisory: The Ongoing Threat of Anubis Ransomware | Anubis Ransomware Hits 91 Victims: Citrix Bleed 2 Bypasses MFA Befo... | Cybercriminal Pressure Grows as Anubis and GlobalSecretGroup Ransom...