Cellini Design Center Listed by qilin Ransomware Group

On October 19, 2025, Singapore-based furniture retailer Cellini Design Center appeared on the leak site of the qilin ransomware group. The company, which sells designer living-room, dining-room and other home furniture online, is claimed to have had internal files exfiltrated after a ransomware attack. The number of people whose information was taken remains unknown, but anyone who has ever placed an order, requested a quote or shared contact details with the retailer could be affected.

What Public Reporting Shows

Public reporting indicates that qilin listed Cellini Design Center on its data-leak portal on 19 October 2025. The attackers claim to have stolen internal files during a ransomware incident. No confirmed customer count has been released, and the precise volume or sensitivity of the documents has not been independently verified. Available reporting describes the exposed material as internal files rather than a structured database of credit-card numbers, yet any customer records, invoices, delivery addresses or email correspondence contained in those files would now be in the hands of the criminals.

Why This Matters for You and Your Family

When a retailer you trusted loses control of its internal documents, your personal information can surface in unexpected places. Delivery addresses, phone numbers and order histories are exactly the details needed to impersonate you with banks, government agencies or other retailers. For families this risk multiplies: one parent’s furniture purchase can expose the shared home address, children’s names on delivery notes, or even linked email accounts used for family logins. Once that data circulates on criminal forums, it rarely stays isolated. What begins as a furniture-store breach can quietly feed larger identity theft attempts months later.

The Doxxing and Identity-Chain Implications

Stolen internal files often contain more than names and addresses. They can include customer support tickets, delivery instructions, or notes that link multiple email addresses, phone numbers and even children’s names. Criminals use these fragments to build identity chains — connecting your shopping handle to your social-media profiles, gaming accounts and real-world identity. A single leaked order confirmation can give attackers the starting point for doxxing campaigns that harass your family or attempt account takeovers elsewhere. Credential leaks like this one frequently cascade into gaming platforms, where children’s accounts become easy targets once an associated parent email or password is exposed.

Qilin’s Publicly Known Track Record

Public reporting attributes the attack to the qilin ransomware group. The gang emerged in 2022 and has since targeted organisations across multiple countries with a double-extortion playbook: first encrypting victim systems, then threatening to publish stolen data unless a ransom is paid. Notable prior victims include healthcare providers, manufacturers and other retailers. Qilin typically gains initial access through compromised credentials or vulnerable remote-desktop services, exfiltrates documents over several days, then posts samples on its leak site with countdown timers. In this case the group followed that pattern, listing Cellini Design Center after the company presumably declined to meet their demands.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers and real identity, then use the cleanup to remove what you can.
• Rotate any password you have ever used at Cellini Design Center — or any site sharing that password — and switch on 2FA through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next leak exposing you or your family is caught in hours, not months.
• Cover the household with DoxxScan family coverage that extends to dependents and children’s gaming accounts, which often chain back to the same home address or parent email.
• Let remediation specialists handle takedown requests across data brokers and leak sites for you while you focus on securing the accounts that matter most.

The incident is a reminder that even ordinary online purchases can become part of a larger data trail criminals exploit. Taking concrete steps now limits how far this claimed breach can reach. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping that connects scattered handles to real identities, and hands-on remediation by specialists who manage takedowns for the entire household — including children’s gaming accounts that are frequently swept up in these cascades.