Mammut Sports Group Listed by datacarry Ransomware Group

On September 27, 2024, Swiss outdoor-equipment maker Mammut Sports Group appeared on the leak site operated by the ransomware group known as datacarry. The listing states that internal files were exfiltrated during a ransomware attack. The company has not yet published a formal breach notification, and the leak-site entry does not disclose the exact number of records involved or the specific categories of data taken.

Reported Details from the Listing

The datacarry leak page indicates that Mammut Sports Group suffered a ransomware intrusion in which attackers copied internal files before encrypting systems. No ransom amount is shown, and the listing does not specify which servers or applications were compromised. Public views of the page confirm that sample files have been published as proof, though the full archive remains behind the group’s typical paywall or negotiation process. Because the primary disclosure provides no customer-record count or list of exposed data types, those details remain unknown to the public.

Why This Matters for You and Your Family

When a company that sells directly to consumers is breached, the information it holds often includes names, addresses, phone numbers, email accounts, order histories, and payment details. Even without an exact count, any Mammut customer or employee should assume their contact information is now at risk. Internal files frequently contain employee records, partner contracts, and customer-support tickets that can be pieced together to build detailed profiles. For families who have purchased climbing gear, backpacks, or apparel from Mammut, this claimed breach means your home address and purchase patterns are potentially circulating among threat actors who trade or extort such data.

Doxxing and Identity-Chain Risks

Exfiltrated internal files rarely stop at one dataset. Attackers combine leaked customer emails with credentials from unrelated breaches, then test those logins on shopping accounts, loyalty programs, and even children’s gaming profiles that reuse the same password. A single exposed order confirmation can link your email address to a physical shipping address, telephone number, and sometimes partial payment-card data. Once those connections are mapped, opportunistic criminals can launch spear-phishing campaigns, SIM-swapping attempts, or straightforward identity theft. The risk extends beyond the initial breach because ransomware groups like datacarry often sell or auction the data on additional underground forums, widening the window of exposure for months or years.

Datacarry’s Known Track Record

Public reporting attributes datacarry as a relatively new ransomware operation that emerged in early 2024. The group follows a classic double-extortion model: it encrypts victim networks and simultaneously exfiltrates sensitive files, then threatens to publish the stolen data unless a ransom is paid. Prior listed victims include mid-sized manufacturing and retail companies across Europe and North America. Typical initial access involves phishing emails or exploited remote-desktop services, followed by rapid lateral movement and data compression for exfiltration. The group’s leak site is used both to pressure victims and to advertise the quality of stolen material to other criminals. While not yet as prolific as some older ransomware families, datacarry’s pace of new listings has increased steadily throughout the year.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, then use the cleanup of Warden to remove what you can.
• Rotate any password you have ever used on the Mammut website or shopping account, and enable 2FA through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next time your information surfaces you learn within hours instead of months.
• Cover the household with DoxxScan family protection that extends to dependents and children’s gaming accounts, which often chain back to the same email or address used for family purchases.
• Let remediation specialists handle ongoing takedown requests for any personal data appearing on broker sites or underground marketplaces that stem from this incident.

The Mammut Sports Group breach is a reminder that even respected consumer brands can become unwilling gateways to your personal information. Acting quickly on credential hygiene and identity mapping limits how far attackers can travel down the chain that begins with one leaked order. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1B+ breach records and 100+ platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that includes children’s gaming accounts. Start your DoxxScan trial today to close the gaps this incident has opened.