NOWFOODS.COM Listed by Clop Ransomware Group

On December 22, 2022, the ransomware group Clop added nowfoods.com to its public leak site, claiming that the vitamin and supplement manufacturer had been hit by a ransomware attack in which internal files were exfiltrated.

Reported Details from the Listing

The Clop leak site listing states that internal files were taken during a ransomware incident but does not disclose the volume of data, the exact types of records, or the number of people whose information appears in the material. The disclosure indicates that negotiations with the company either failed or never occurred, a common trigger for Clop to publish victim names and samples. No customer record count is provided, and the listing does not specify which systems were initially compromised. Public reporting on Clop’s past behavior shows the group typically posts only a small sample of stolen data as proof while holding the remainder for extortion.

Why This Matters for You and Your Family

If you have ever ordered vitamins, supplements, or essential oils from NOW Foods, your name, shipping address, email, phone number, and payment details may be among the internal files now in criminal hands. Even if the leak site does not list every data type, retail purchase records almost always contain exactly that combination of personal and financial information. For many families these details are enough for identity thieves to open accounts, file fraudulent tax returns, or impersonate you with retailers and banks. The breach affects not only direct customers but also anyone whose information was stored in supplier, partner, or employee files that were swept up in the same exfiltration.

Doxxing and Identity-Chain Risks

Stolen internal files frequently contain more than order history. They can link email addresses to usernames used on forums, loyalty programs, or children’s gaming accounts. Once criminals possess one valid credential from a NOW Foods purchase, they test it across other services in a process known as credential stuffing. A single reused password can cascade into full account takeovers that expose photos, chat logs, and location data. These linkages create persistent doxxing chains that follow a person or household for years. Children’s gaming accounts are especially vulnerable because parents often reuse the same email or password patterns established during family supplement orders.

Clop’s Publicly Known Track Record

Public reporting attributes the first major activity by Clop to early 2019. The group rose to prominence in 2021 after it began exploiting a vulnerability in the Accellion FTA file-transfer appliance, later shifting to other initial-access methods including phishing and ransomware-as-a-service partnerships. Notable prior victims include large healthcare systems, financial institutions, and consumer-goods companies. Clop’s typical playbook involves quiet exfiltration of data before encryption, followed by extortion demands directed at both the victim company and, in some cases, the company’s customers. The group has repeatedly published sensitive files when ransoms are not paid, using its dark-web leak site to apply public pressure. The exact ransom amount demanded from NOW Foods remains unknown.

What to do

• Rotate any password you ever used at nowfoods.com and enable 2FA with an authenticator app everywhere that password was reused.
• Run a DoxxScan to map every link between your emails, phone numbers, usernames, and real-world identity, with cleanup handled by the service.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure surfaces in hours rather than months.
• Cover the household with DoxxScan family protection that extends to dependents and children’s gaming accounts that often chain back to the same credentials.
• Let DoxxScan remediation specialists manage takedown requests for any exposed personal records appearing on data-broker or extortion sites.

The incident underscores that even purchases as routine as vitamins can become the starting point for long-term identity exposure. Staying ahead requires more than one-time checks. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1B+ breach records and 100+ platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that includes children’s gaming accounts. Start your DoxxScan trial today to close the gaps this claimed breach and future ones can exploit.