DLCOSMETICS O.E. Listed by RansomHouse Ransomware Group

On August 6, 2025, Greek online cosmetics retailer cosmetics.gr appeared on the RansomHouse leak site after the company’s internal files were allegedly exfiltrated in a ransomware attack.

What Public Reporting Shows

Available reporting describes DLCOSMETICS O.E., the company behind cosmetics.gr, as a retailer and wholesaler of cosmetics, perfumes, beauty accessories, and hair care products. The site collects names, addresses, and contact details from customers to process and deliver orders. Public reporting indicates that attackers gained access to internal files containing this information, although the exact number of affected records remains unknown. The data was published on the RansomHouse leak site, which is accessible via the onion link http://zohlm7ahjwegcedoz7lrdrti7bvpofymcayotp744qhx6gjmxbuo2yid.onion/r/9c5a69ed096334385c49dd2ef3f63ae860dd7a40.

Industry research from sources such as DoxxScan™ continuous monitoring indicates that retail breaches frequently expose exactly the types of personal and shipping information needed for identity theft and phishing. No confirmation has yet emerged on whether payment card details were included.

Why This Matters for You and Your Family

If you or anyone in your household has ever placed an order with cosmetics.gr, your full name, delivery address, phone number, and email address may now be in the hands of criminals. That combination is enough for scammers to impersonate delivery services, create convincing phishing emails, or open accounts in your name. When children’s details are linked through a family order or shared address, the exposure can reach younger family members who do not yet have their own credit history but are old enough to use email or gaming accounts.

Retail customer data like this travels quickly on underground forums. Once it is out, you cannot force every copy to disappear. The breach therefore shifts the burden onto you to watch for misuse of your information.

The Doxxing and Identity-Chain Implications

A single retailer breach rarely stays isolated. Criminals combine the exposed name-and-address records with usernames found on other sites, creating an identity chain that links your shopping habits to your social-media handles, gaming accounts, and sometimes workplace details. Public reporting shows these chains are then used for doxxing, targeted phishing, or extortion. Gaming accounts belonging to you or your children are especially vulnerable because the same email or password reused for a cosmetics purchase can unlock those accounts, exposing friends lists, chat logs, and payment methods.

RansomHouse Track Record

Public reporting attributes the attack to the RansomHouse ransomware group. The group first appeared in 2021 and has since listed hundreds of victims across retail, healthcare, and manufacturing sectors. Its typical playbook involves initial access through phishing or exploited remote desktop services, followed by claimed exfiltration of internal documents and customer databases. RansomHouse then demands payment for deletion of the stolen data and, if unpaid, publishes samples on its leak site to pressure the victim. The group does not always deploy ransomware encryption; in many cases it relies solely on data theft and extortion.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity so you can see exactly what chains exist from this claimed breach.
• Rotate the password you used at cosmetics.gr anywhere else it is reused, and switch on two-factor authentication through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next time your information surfaces you learn within hours instead of months.
• Cover the household with DoxxScan family coverage that extends to dependents and children’s gaming accounts that often chain back to the same address or email.
• Let the remediation specialists handle takedown requests across data brokers and suspicious sites for you while you focus on securing your own accounts.

The cosmetics.gr breach is a reminder that everyday online shopping can quietly feed larger identity crimes. Taking concrete steps now limits how far criminals can travel down the chain that begins with your name and address. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that includes children’s gaming accounts. Start your DoxxScan trial today to regain control of your exposed information.