Perrigo Company Listed by termite Ransomware Group

On March 14, 2025, pharmaceutical manufacturer Perrigo appeared on the leak site of the termite ransomware group, with the attackers claiming to have exfiltrated internal files during a ransomware incident.

Reported Details from Reporting

Public reporting indicates that Perrigo, founded in 1887 and headquartered in Dublin, Ireland, is a global supplier and manufacturer of private-label over-the-counter pharmaceuticals. The termite ransomware group posted evidence of the breach on its leak site, accessible via the .onion address tracked by ransomware.live. Available reporting describes the exposed material as internal files, though the precise volume and full list of data types have not been independently verified in open sources. No confirmed victim count for individuals has been released, and it remains unclear exactly which categories of sensitive information—such as employee records, customer details, or supplier contracts—were taken.

Why This Matters for You and Your Family

When a healthcare supplier like Perrigo suffers a breach, the ripple effects can reach ordinary families who rely on its products or whose information sits in its systems. Internal files often contain names, addresses, dates of birth, contact details, and sometimes payment or insurance information. Once that data leaves the company’s control, it can surface on dark-web markets, fueling identity theft, fraudulent tax filings, or medical fraud in your name. For parents, the exposure of family-linked records can also put children at risk, especially when gaming accounts or school-related details share the same email addresses or passwords used for healthcare services.

March 14, 2025 marks the public confirmation of this incident. The longer the stolen data circulates without action, the higher the chance it will be packaged and sold. Families cannot assume that a large corporation will notify every affected person quickly or completely.

The Doxxing and Identity-Chain Risks

Ransomware leaks rarely stop at one company. Stolen internal files frequently include employee directories, vendor lists, or customer spreadsheets that link names to emails, phone numbers, and physical addresses. Attackers and data brokers then combine these fragments with information from other breaches, creating detailed identity chains. A single leaked work email can lead to your personal accounts, social-media handles, and even your children’s gaming profiles. Credential leaks like this one routinely cascade into account takeovers, doxxing campaigns, and harassment that crosses from corporate networks into home life.

Termite Group’s Known Track Record

Public reporting attributes the termite ransomware group with a growing list of attacks since it first gained attention in the ransomware ecosystem. The group typically gains initial access through phishing, remote-desktop vulnerabilities, or stolen credentials, exfiltrates data before deploying ransomware, and then pressures victims with threats of public leaks on its dedicated site. Notable prior victims include organizations across healthcare, manufacturing, and logistics sectors, though exact details remain limited in open sources. Its playbook relies on double extortion: encrypting systems while holding stolen files for ransom, then listing non-paying targets on the leak site to increase pressure.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, handles, and real-world identity, with cleanup of findings.
• Rotate any password you used at Perrigo or related healthcare services anywhere it has been reused, and switch on 2FA through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure of your information is caught in hours, not months.
• Cover the household with DoxxScan family coverage that extends to dependents and children’s gaming accounts that often chain back to the same addresses and credentials.
• Let remediation specialists handle takedown requests across data brokers and leak sites for you while you focus on securing day-to-day accounts.

The incident underscores a simple reality: corporate breaches are now routine, and your family’s information is only as safe as the weakest link in the chain of companies that hold it. Taking concrete steps now can limit the damage from this leak and reduce exposure to future ones. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping that connects scattered online handles to real identities, and hands-on remediation by specialists who manage takedowns on your behalf, with household coverage that includes children’s gaming accounts vulnerable to credential-based attacks.