On March 14, 2026, the Australian teddy bear company charliebears.com.au appeared on the LockBit 5 ransomware leak site with internal files reportedly exfiltrated during an attack. Customers who have placed orders, joined loyalty programs, or contacted the company may have personal information now exposed.
Already exposed?
You can’t unleak data. You can take away what it’s worth.
A leaked record is where it starts, not where it ends. What turns it into your front door is the look-up sites publishing your address beside your name — and those are what an AI reads when somebody asks about you. The free scan shows you both. We write to 580 companies.
See what is exposed about you — free scan →Watch charliebears.com.au
Get alerted the next time charliebears.com.au files a breach with any US regulator — the filing, dated and sourced. A free single-company slice of Signals; no account needed.
We’ll email you only about charliebears.com.au’s future breach filings and how to watch a whole vendor list — not general marketing. Unsubscribe any time.
Watching your whole vendor list (50 to 500 companies, by tier) is GalaxyWarden Signals.
What Public Reporting Shows
Public reporting indicates that LockBit 5 listed charliebears.com.au and began publishing what it claims are stolen internal documents. The exact number of people affected remains unknown, but the data includes files that typically contain customer names, addresses, order details, email addresses, and phone numbers in a retail environment of this type. No evidence has surfaced that payment card data was taken, yet the breadth of internal records still creates serious exposure. The listing appeared on the group’s onion site, which serves as both shaming platform and data repository for victims who refuse to pay.
Why This Matters for You and Your Family
When a family-owned or specialty retailer like Charlie Bears suffers a breach, the information leaked often ties directly to real households. Customer addresses, children’s names on gift orders, and family email accounts can be harvested quickly. Once criminals possess even modest personal details, they can launch credential-stuffing attacks against banks, schools, or government portals. For parents, the risk extends to children whose names and birth dates sometimes appear in order notes or loyalty registrations. A single breach like this can quietly feed months of identity theft attempts that surface only when tax documents are rejected or strange charges appear.
The Doxxing and Identity-Chain Risk
Stolen retail records rarely stay isolated. Attackers combine names, emails, and addresses with information already circulating on forums and paste sites. This creates an identity chain that links your shopping handle to gaming usernames, social media profiles, and eventually physical locations. Public reporting shows these chains frequently lead to doxxing, swatting, or targeted harassment. Credential leaks from one site cascade into account takeovers across unrelated services, especially gaming platforms popular with children and teenagers. A seemingly harmless teddy bear purchase can therefore become the first link in a chain that compromises family privacy for years.