Sponsored by Hudson Rock – Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks

Enjoying ransomware.live? Help us keep tracking ransomware gangs and shipping new features. Support us

EWM Group

EWM Group

Group Aurora
Discovered 2026-10-28 13:00 UTC
Est. attack date 2026-10-28
Country GB
Sector
Agriculture and Food Production Education Energy & Utilities Financial Services Government & Defense Healthcare Hospitality Manufacturing Other Professional Services Retail & E-Commerce Technology Transportation

Description:

[fashion] EWM Group — the parent group behind Bonmarché, Edinburgh Woollen Mill, and Peacocks, three of the UK's best-known value fashion chains. The exposed material includes: 503,878 loyalty programme member records — full name, home address, date of birth, phone, mobile, email, loyalty card number, and transaction history spanning 2000–2026. ~21,000 employee records — salary, National Insurance number (via P11D), bank sort code and account number (WAGESTRANSFER database), home address, emergency contacts, maternity/paternity data, sickness absence, accident reports with injury details. <redacted> <redacted> <redacted> <redacted> <redacted> 100+ GB of Outlook PST email archives — complete email histories for named staff members spanning years of business operations. 313+ SQL Server database backups across 122 unique databases — the entire digital brain of the retail operation. 83 GB of e-commerce transaction data — every online order from January 2021 to August 2026.

Exposure Report
by ParanoidLab
0
Passwords
0 critical
0
Cookies
0 critical
Last queried 2026-10-28 12:59 UTC


Leak Screenshot:

Leak Screenshot

Other recent victims