# Spirals Ransomware Group Targets U.S. Contractor

On September 18, 2026, the Spirals ransomware group launched a cyberattack against ANYTHINGIT, a U.S.-based IT Asset Disposition company that supports federal agencies and defense contractors. The attack involved threats of data exposure, highlighting the growing cybersecurity risks faced by government contractors handling sensitive information. This incident emphasizes the urgent need for federal procurement professionals and contractors to strengthen cybersecurity defenses, implement continuous monitoring, and enhance incident response capabilities to protect critical supply chains and sensitive government data.

- Federal agencies and defense contractors should reassess cybersecurity requirements and contract clauses to address ransomware threats targeting supply chain partners.
- Contractors in IT asset disposition and related sectors must prioritize robust cybersecurity measures to maintain eligibility for government contracts.
- Procurement officials may consider incorporating stricter cybersecurity standards and incident reporting mandates in upcoming solicitations.
- This event signals increased cyber risk exposure for contractors, underscoring the importance of proactive risk management and vendor vetting in government procurement processes.

**Jurisdictions:** federal
**Industries:** Information Technology, Defense & Military
**Topics:** Cybersecurity
**Published:** September 18, 2026

### Government Entities
- Federal Agencies
- Defense Contractors

### Vendors
- ANYTHINGIT (targeted company)

### Sources
- [Spirals Ransomware Group Strikes AnythingIT in the USA - DeXpose](https://www.dexpose.io/spirals-ransomware-group-strikes-anythingit-in-the-usa) - DeXpose