Crumbl - Full leak published Listed by everest Ransomware Group

On July 23, 2025, the Everest ransomware group published what it claims are internal files stolen from Crumbl, the popular cookie retailer with locations across the United States. The data exposure affects anyone who has ordered from Crumbl, created an account on its website or app, or whose contact information appears in the company’s internal records.

What's Publicly Reported from Reporting

Public reporting indicates that Everest posted the Crumbl materials to its leak site on July 23, 2025. The files are described as internal documents exfiltrated during a ransomware incident. Exact victim counts have not been disclosed, and the precise categories of data remain under review by security researchers. Available reporting describes the incident as a classic ransomware operation in which attackers first gain access, exfiltrate information, and then threaten to publish it unless a ransom is paid.

Industry trackers such as DoxxScan™ continuous monitoring have not yet incorporated this specific leak, which is typical for fresh ransomware publications. The absence of an official Crumbl statement at the time of publication leaves many customers uncertain about whether their specific records were taken.

Why This Matters for You and Your Family

When a company like Crumbl loses control of internal files, the information inside often includes names, email addresses, phone numbers, physical addresses, and order histories. Any of these details can be combined with data from previous breaches to build a more complete picture of your household. Credential leaks from one service frequently cascade into others because people reuse passwords across shopping, banking, and social accounts.

For families this means children’s accounts, shared family emails, or even gaming profiles linked to the same address can become targets. A single exposed phone number or parent’s email can lead to phishing attempts aimed at younger family members who may not recognize the risk. The breach therefore extends beyond the individual customer to everyone whose details live in the same digital household.

The Doxxing and Identity-Chain Implications

Ransomware groups rarely stop at publishing one file dump. Once internal documents surface, opportunistic actors scrape them for email addresses, usernames, and any personal identifiers. These fragments are then fed into automated tools that link gaming handles, social-media profiles, and real-world addresses. The result is an identity chain that can be used for harassment, SIM-swapping, or targeted scams.

Credential leaks like this one are especially dangerous because they often expose passwords or password hints that work on multiple services. A compromised Crumbl account password reused on a child’s Roblox or Fortnite account can quickly lead to full takeover, doxxing, and further leaks. The chain grows faster than most people realize, turning a cookie-ordering habit into a persistent privacy problem.

Everest Ransomware Group Track Record

Public reporting attributes the attack to the Everest ransomware group, which emerged in 2021. The group has targeted hospitals, schools, retailers, and technology companies in the years since. Notable prior victims include healthcare providers and mid-sized manufacturers whose employee and customer records were published after ransom demands went unpaid.

Everest’s typical playbook involves initial access through phishing or exploited remote-desktop services, followed by extensive exfiltration of internal shares and databases. The group then posts samples on its leak site and sets a deadline for payment. If the target does not pay, Everest releases larger batches of data in stages, aiming to increase pressure and attract secondary buyers who may weaponize the information for identity theft or extortion.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, then use the cleanup to remove what you can.
• Rotate the password you used at Crumbl anywhere it is reused and enable 2FA through an authenticator app rather than text messages.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next leak that touches your family is caught in hours, not months.
• Cover the household with DoxxScan family coverage that extends to dependents and children’s gaming accounts that often chain back to the same address or parent email.
• Let remediation specialists handle takedown requests across data brokers and leak sites while you focus on securing your own accounts.

The Crumbl incident is a reminder that retail breaches now feed directly into larger doxxing ecosystems. Taking concrete steps today limits how far attackers can travel down the identity chain that begins with a simple cookie order. Start your DoxxScan trial and combine it with basic password hygiene and household-wide coverage; DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1B+ breach records and 100+ platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full family protection that includes children’s gaming accounts.