On January 12, 2024, textile manufacturer Pharr Yarns (pharrusa.com) appeared on the leak site operated by the threeam ransomware group. The listing states that internal files were exfiltrated during a ransomware attack. The company, headquartered in McAdenville, North Carolina, has not published a public breach notification detailing the number of records affected or the precise data categories involved.
Already exposed?
You can’t unleak data. You can take away what it’s worth.
A leaked record is where it starts, not where it ends. What turns it into your front door is the look-up sites publishing your address beside your name — and those are what an AI reads when somebody asks about you. The free scan shows you both. We write to 580 companies.
See what is exposed about you — free scan →Watch pharrusa.com
Get alerted the next time pharrusa.com files a breach with any US regulator — the filing, dated and sourced. A free single-company slice of Signals; no account needed.
We’ll email you only about pharrusa.com’s future breach filings and how to watch a whole vendor list — not general marketing. Unsubscribe any time.
Watching your whole vendor list (50 to 500 companies, by tier) is GalaxyWarden Signals.
Details in the Leak-Site Listing
The threeam leak site entry states that Pharr Yarns suffered a ransomware intrusion and that attackers successfully removed internal files before encryption. No specific volume of data or list of exposed record types is provided in the posting. The disclosure indicates the incident falls under the group’s double-extortion model, in which stolen data is held for ransom and later published if demands are not met. Public reporting on threeam shows the group typically posts samples or full archives after an initial negotiation window expires.
Why This Matters for You and Your Family
Even when a breach involves corporate internal files rather than obvious customer databases, the exposed material frequently contains spreadsheets, emails, contracts, or employee records that include personal details. If your name, address, Social Security number, or contact information appears in any of those files, the breach creates a direct pathway for identity theft, tax fraud, or targeted phishing. Families are affected because one compromised employee record can expose household addresses, dependent names, and financial relationships that criminals later exploit.
Doxxing and Identity-Chain Risks
Internal files often link corporate email addresses to personal phone numbers, home addresses, and sometimes spouse or child information. Once published on a ransomware leak site, that data spreads quickly to other criminal forums. Attackers then combine it with credential leaks from unrelated breaches to build complete identity chains. These chains allow doxxing that can reach family members, including children whose names and locations become visible through parent-employee records. Credential leaks like this one routinely cascade into account takeovers on personal email, banking, and gaming platforms.