On June 9, 2024, the ransomware group known as BlackSuit listed a-g.com on its leak site and gave the company four days to contact the attackers or face full publication of 38 GB of stolen internal files affecting an estimated 150,000 records.
Already exposed?
You can’t unleak data. You can take away what it’s worth.
A leaked record is where it starts, not where it ends. What turns it into your front door is the look-up sites publishing your address beside your name — and those are what an AI reads when somebody asks about you. The free scan shows you both. We write to 580 companies.
See what is exposed about you — free scan →Watch a-g.com
Get alerted the next time a-g.com files a breach with any US regulator — the filing, dated and sourced. A free single-company slice of Signals; no account needed.
We’ll email you only about a-g.com’s future breach filings and how to watch a whole vendor list — not general marketing. Unsubscribe any time.
Watching your whole vendor list (50 to 500 companies, by tier) is GalaxyWarden Signals.
Primary Disclosure Details
The BlackSuit leak-site entry, still accessible via the onion link hosted on ransomware.live, states that data was exfiltrated during a ransomware attack and warns “You have 4 days to contact us; otherwise the data will be released.” The listing does not specify the exact data types beyond “internal files,” nor does it quantify the number of individuals whose information appears in the 38 GB archive. The disclosure indicates the material was taken from a-g.com systems and that publication would follow if the extortion demand went unmet. As of the listing date, the group had already begun counting down the short negotiation window typical of its playbook.
Why This Matters for You and Your Family
When a company that handles customer orders, payments, or personal accounts suffers a ransomware breach, the people most exposed are ordinary customers like you and your household. Even though the exact records inside the 38 GB are not detailed in the listing, internal files from retail or service businesses routinely contain names, addresses, phone numbers, email addresses, order histories, and sometimes payment card details. Once published on a dark-web leak site, that information becomes freely available to identity thieves, phishing crews, and stalkers. Your family’s day-to-day exposure grows because one compromised email or phone number can unlock additional accounts that share the same credentials.
Doxxing and Identity-Chain Risks
Published ransomware data rarely stays isolated. A single email address or username allegedly taken from a-g.com can be cross-referenced against dozens of other breaches, quickly linking your gaming handles, social-media profiles, and real-world identity. Attackers then weaponize these chains for doxxing, SIM-swapping, or targeted extortion. Credential leaks of this kind frequently cascade into account takeovers on Steam, Roblox, Discord, and other platforms used by children and teenagers. The speed of modern data aggregation means the window between initial publication and widespread abuse is now measured in hours rather than weeks.