Cohen's Fashion Optical Listed by sinobi Ransomware Group

On October 27, 2025, Cohen's Fashion Optical was listed on the leak site of the sinobi ransomware group after the company suffered a ransomware attack in which internal files were exfiltrated.

What's Publicly Reported from Reporting

Public reporting indicates that Cohen's Fashion Optical, a New York City-based optical retailer selling eyeglasses, frames, sunglasses, contact lenses and accessories, had data taken during the incident. The company also offers professional eye exams with on-site Doctors of Optometry. Available reporting describes the exposed material as internal files. The number of individuals whose information was compromised remains unknown at this time.

The listing appeared on the sinobi ransomware group's dedicated leak site, which is accessible via the Tor network. No specific deadline for payment or further data publication has been publicly detailed in available reporting.

Why This Matters for You and Your Family

When a retailer like Cohen's Fashion Optical is hit, the information stolen can include customer records, employee details, supplier contracts, and other documents that contain names, addresses, phone numbers, email addresses, and payment information. If you or your family have ever shopped there, had an eye exam, or provided contact details for warranty or prescription services, your data may now be in attackers' hands.

Credential leaks from such incidents frequently cascade into account takeovers elsewhere. A password or email address reused from a Cohen's account can give criminals access to your banking, email, or social media. For families this risk extends to children's accounts, especially gaming platforms where the same email or password may be used.

The Doxxing and Identity-Chain Implications

Stolen internal files often contain enough personal details to begin building an identity chain. Attackers link an email address to a phone number, then to a home address, social media handles, and family relationships. Once that chain exists, it can be sold or used for targeted doxxing, identity theft, or harassment.

Children's gaming accounts are particularly vulnerable because they frequently share the same household email or phone number. A breach at an optical retailer can therefore expose the entire family if one reused credential leads to a gaming profile that reveals real names, locations, or photos.

Sinobi Ransomware Group's Track Record

Public reporting attributes the attack to the sinobi ransomware group. The group emerged in recent years and has targeted organizations across multiple sectors by deploying ransomware to encrypt systems, exfiltrating data beforehand, and then threatening to publish the stolen information unless a ransom is paid. Their typical playbook involves initial access through common vulnerabilities or phishing, followed by data theft and extortion via leak sites. Notable prior victims have included other retail and service companies, though exact details vary by incident.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, handles, and real-world identity so you can see exactly what chains back to the Cohen's Fashion Optical breach.
• Rotate any password you used at Cohen's Fashion Optical anywhere else it is reused, and switch to 2FA through an authenticator app rather than text messages.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next leak exposing you or your family is caught in hours instead of months.
• Cover the household with DoxxScan family coverage that includes dependents and children's gaming accounts that often chain back to the same address or credentials.
• Let DoxxScan remediation specialists handle takedown requests across data brokers and exposed records while you focus on securing your own accounts.

The incident is a reminder that retail breaches continue to expose ordinary families to long-term identity risks that do not end when the news cycle moves on. Starting with a clear map of your exposure and putting continuous protection in place gives you the best chance of staying ahead of attackers who already hold the data. DoxxScan by GalaxyWarden delivers that combination of continuous monitoring across 13.1B+ breach records and 100+ platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage including children's gaming accounts.