charliebears.com.au Listed by lockbit5 Ransomware Group

On March 14, 2026, the Australian teddy bear company charliebears.com.au appeared on the LockBit 5 ransomware leak site with internal files exfiltrated during an attack. Customers who have placed orders, joined loyalty programs, or contacted the company may have personal information now exposed.

What's Publicly Reported from Reporting

Public reporting indicates that LockBit 5 listed charliebears.com.au and began publishing what it claims are stolen internal documents. The exact number of people affected remains unknown, but the data includes files that typically contain customer names, addresses, order details, email addresses, and phone numbers in a retail environment of this type. No evidence has surfaced that payment card data was taken, yet the breadth of internal records still creates serious exposure. The listing appeared on the group’s onion site, which serves as both shaming platform and data repository for victims who refuse to pay.

Why This Matters for You and Your Family

When a family-owned or specialty retailer like Charlie Bears suffers a breach, the information leaked often ties directly to real households. Customer addresses, children’s names on gift orders, and family email accounts can be harvested quickly. Once criminals possess even modest personal details, they can launch credential-stuffing attacks against banks, schools, or government portals. For parents, the risk extends to children whose names and birth dates sometimes appear in order notes or loyalty registrations. A single breach like this can quietly feed months of identity theft attempts that surface only when tax documents are rejected or strange charges appear.

The Doxxing and Identity-Chain Risk

Stolen retail records rarely stay isolated. Attackers combine names, emails, and addresses with information already circulating on forums and paste sites. This creates an identity chain that links your shopping handle to gaming usernames, social media profiles, and eventually physical locations. Public reporting shows these chains frequently lead to doxxing, swatting, or targeted harassment. Credential leaks from one site cascade into account takeovers across unrelated services, especially gaming platforms popular with children and teenagers. A seemingly harmless teddy bear purchase can therefore become the first link in a chain that compromises family privacy for years.

LockBit 5 Track Record

Public reporting attributes ongoing activity to LockBit 5 after the original LockBit group’s infrastructure was disrupted in early 2024. The collective rebranded and continued operations, claiming victims across healthcare, manufacturing, and retail. Their typical playbook begins with initial access through compromised credentials or remote desktop vulnerabilities, followed by rapid exfiltration of internal shares before encryption. Extortion combines public shaming on the leak site with direct threats to publish sensitive files unless payment is made. Retail and consumer-facing companies have featured regularly in their listings because customer databases provide immediate leverage.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, then use the cleanup to remove what appears.
• Rotate the password you used at charliebears.com.au anywhere else it is reused and enable 2FA through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure is caught in hours instead of months.
• Cover the household with DoxxScan family protection that extends to dependents and children’s gaming accounts that often chain back to the same address and email.
• Let remediation specialists handle takedown requests across data brokers and exposed profiles on your behalf while you focus on securing accounts.

The incident underscores that even purchases from trusted specialty retailers can feed larger identity chains if companies cannot protect their internal files. Starting with concrete steps to map and break those chains gives you and your family the clearest path forward. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that includes children’s gaming accounts. Its specialists routinely close the exact exposure paths this type of retail breach opens.