On September 27, 2024, Swiss outdoor-equipment maker Mammut Sports Group appeared on the leak site operated by the ransomware group known as datacarry. The listing states that internal files were exfiltrated during a ransomware attack. The company has not yet published a formal breach notification, and the leak-site entry does not disclose the exact number of records involved or the specific categories of data taken.
Already exposed?
You can’t unleak data. You can take away what it’s worth.
A leaked record is where it starts, not where it ends. What turns it into your front door is the look-up sites publishing your address beside your name — and those are what an AI reads when somebody asks about you. The free scan shows you both. We write to 580 companies.
See what is exposed about you — free scan →Watch Mammut Sports Group
Get alerted the next time Mammut Sports Group files a breach with any US regulator — the filing, dated and sourced. A free single-company slice of Signals; no account needed.
We’ll email you only about Mammut Sports Group’s future breach filings and how to watch a whole vendor list — not general marketing. Unsubscribe any time.
Watching your whole vendor list (50 to 500 companies, by tier) is GalaxyWarden Signals.
Reported Details from the Listing
The datacarry leak page indicates that Mammut Sports Group suffered a ransomware intrusion in which attackers copied internal files before encrypting systems. No ransom amount is shown, and the listing does not specify which servers or applications were compromised. Public views of the page confirm that sample files have been published as proof, though the full archive remains behind the group’s typical paywall or negotiation process. Because the primary disclosure provides no customer-record count or list of exposed data types, those details remain unknown to the public.
Why This Matters for You and Your Family
When a company that sells directly to consumers is breached, the information it holds often includes names, addresses, phone numbers, email accounts, order histories, and payment details. Even without an exact count, any Mammut customer or employee should assume their contact information is now at risk. Internal files frequently contain employee records, partner contracts, and customer-support tickets that can be pieced together to build detailed profiles. For families who have purchased climbing gear, backpacks, or apparel from Mammut, this claimed breach means your home address and purchase patterns are potentially circulating among threat actors who trade or extort such data.
Doxxing and Identity-Chain Risks
Exfiltrated internal files rarely stop at one dataset. Attackers combine leaked customer emails with credentials from unrelated breaches, then test those logins on shopping accounts, loyalty programs, and even children’s gaming profiles that reuse the same password. A single exposed order confirmation can link your email address to a physical shipping address, telephone number, and sometimes partial payment-card data. Once those connections are mapped, opportunistic criminals can launch spear-phishing campaigns, SIM-swapping attempts, or straightforward identity theft. The risk extends beyond the initial breach because ransomware groups like datacarry often sell or auction the data on additional underground forums, widening the window of exposure for months or years.