On July 18, 2025, German e-commerce services provider Expert E-commerce GmbH appeared on the leak site of the Medusa ransomware group with 114 GB of internal files now publicly listed for download.
Already exposed?
You can’t unleak data. You can take away what it’s worth.
A leaked record is where it starts, not where it ends. What turns it into your front door is the look-up sites publishing your address beside your name — and those are what an AI reads when somebody asks about you. The free scan shows you both. We write to 580 companies.
See what is exposed about you — free scan →Watch Expert E-commerce GmbH
Get alerted the next time Expert E-commerce GmbH files a breach with any US regulator — the filing, dated and sourced. A free single-company slice of Signals; no account needed.
We’ll email you only about Expert E-commerce GmbH’s future breach filings and how to watch a whole vendor list — not general marketing. Unsubscribe any time.
Watching your whole vendor list (50 to 500 companies, by tier) is GalaxyWarden Signals.
What Public Reporting Shows
Expert E-commerce GmbH, founded in 1999 and based in Langenhagen, Germany, supplies online support services to specialist stores within the Expert SE retail group. Public reporting indicates the company suffered a ransomware intrusion in which attackers exfiltrated 114 GB of internal documents before encrypting systems. The Medusa group posted proof of the breach on its dark-web leak portal, giving the victim a short window to negotiate before full data publication. Available reporting describes the exposed material as sensitive internal files; the exact number of individuals whose personal data may be contained remains unknown at this time.
Why This Matters for You and Your Family
When a company that processes orders, payments, and customer records for hundreds of retail stores is breached, the information it holds can include names, addresses, email accounts, phone numbers, and payment details tied to ordinary shoppers and their households. 114 GB is a substantial volume that can easily contain spreadsheets or databases linking real people to their purchase histories. Once that data reaches underground forums, it can be resold and combined with other leaks, increasing the chance that someone targeting you or your family already has enough pieces to attempt identity theft, phishing, or account takeovers. Your family’s exposure does not require you to have been a direct customer; suppliers, partners, and even employees’ families can be swept up in the same dataset.
The Doxxing and Identity-Chain Risk
Ransomware leaks rarely stop at one company’s files. Attackers and subsequent buyers map relationships between leaked emails, usernames, phone numbers, and addresses to build complete identity chains. A single credential from this claimed breach can unlock connected accounts on shopping sites, loyalty programs, or email services. Public reporting shows these chains frequently lead to doxxing, where personal details are published alongside family member names or children’s usernames. Gaming accounts are especially vulnerable because kids often reuse simple passwords or email addresses that appear in adult-oriented breaches like this one. The result is a cascade: one exposed record becomes the key that opens multiple doors.