On March 3, 2025, O'Neill, the California-based maker of wetsuits, swimwear, and outdoor clothing, appeared on the leak site of the ransomware group known as RansomHub. The attackers claim to have exfiltrated internal files during a ransomware incident. The exact number of people whose information is contained in those files remains unknown, but anyone who has ever purchased from oneill.com, worked at the company, or had their details stored in its systems could be affected.
Already exposed?
You can’t unleak data. You can take away what it’s worth.
A leaked record is where it starts, not where it ends. What turns it into your front door is the look-up sites publishing your address beside your name — and those are what an AI reads when somebody asks about you. The free scan shows you both. We write to 580 companies.
See what is exposed about you — free scan →Watch oneill.com
Get alerted the next time oneill.com files a breach with any US regulator — the filing, dated and sourced. A free single-company slice of Signals; no account needed.
We’ll email you only about oneill.com’s future breach filings and how to watch a whole vendor list — not general marketing. Unsubscribe any time.
Watching your whole vendor list (50 to 500 companies, by tier) is GalaxyWarden Signals.
What Public Reporting Shows
Public reporting indicates that RansomHub added a new entry for O'Neill to its dark-web leak portal on that date. The listing states that internal files were taken during a ransomware attack. No sample data has been publicly released at the time of writing, and the precise volume or sensitivity of the stolen information has not been independently verified. O'Neill, founded in 1952, sells products worldwide and maintains customer records, employee data, and supplier information that would typically reside in the kinds of corporate systems targeted in these attacks.
Why This Matters for You and Your Family
When a company like O'Neill suffers a breach, the information exposed can include names, addresses, email accounts, phone numbers, and payment details tied to past purchases. That data does not stay isolated. Once it reaches criminal networks, it can be combined with other records to build a profile of you and the people you live with. For families this often means children’s names and dates of birth appearing alongside parental contact information, increasing the chance that every member of the household becomes a target for identity theft, phishing, or harassment. Customer purchase records and employee files from a single breach can supply the starting point for months of follow-on fraud.
The Doxxing and Identity-Chain Risk
Stolen corporate files frequently contain more than names and emails. They can list usernames, account numbers, or references to external systems that link your shopping history to gaming accounts, social-media handles, or family-shared logins. Attackers follow these connections to map an entire household. A credential leak from an online clothing retailer can cascade into takeover of a child’s gaming account that uses the same password or recovery email. Once one account falls, the attacker gains additional personal details that make further doxxing easier. This identity-chain effect turns a single breach into a long-term exposure that affects every device and online service tied to your family.