On September 29, 2025, the Canadian company PHI Studio appeared on the leak site of the incransom ransomware group in a listing claiming internal files were exfiltrated during a ransomware attack. The firm, which creates immersive experiences in virtual reality, augmented reality, and extended reality, has not publicly confirmed the number of people whose information may have been exposed.
Already exposed?
You can’t unleak data. You can take away what it’s worth.
A leaked record is where it starts, not where it ends. What turns it into your front door is the look-up sites publishing your address beside your name — and those are what an AI reads when somebody asks about you. The free scan shows you both. We write to 580 companies.
See what is exposed about you — free scan →Watch phi.ca
Get alerted the next time phi.ca files a breach with any US regulator — the filing, dated and sourced. A free single-company slice of Signals; no account needed.
We’ll email you only about phi.ca’s future breach filings and how to watch a whole vendor list — not general marketing. Unsubscribe any time.
Watching your whole vendor list (50 to 500 companies, by tier) is GalaxyWarden Signals.
Reported Details of the Incident
Public reporting indicates that incransom added PHI Studio to its disclosures page on September 29, 2025. The group claims to have stolen internal files during a ransomware incident. No specific count of affected individuals has been released, and the precise volume or sensitivity of the exfiltrated data remains unclear from available reporting. The company’s work focuses on curation and presentation of VR, AR, and XR content, which suggests that project files, client information, and employee records could be among the stolen material.
Why This Matters for You and Your Family
When a company that handles creative projects and client relationships suffers a breach, the information exposed can easily reach your household. If you or your family members have interacted with PHI Studio—whether through events, beta testing, purchases, or employment—the leaked files may contain names, email addresses, phone numbers, or other details that attackers can use. Credential leaks like this one often cascade into account takeovers on other services where the same password or email combination is reused. Children who participated in family-oriented VR experiences or used linked gaming accounts are especially vulnerable because their information can be tied back to a parent’s identity.
The Doxxing and Identity-Chain Risks
Stolen internal files frequently include more than just names and emails. They can contain notes, chat logs, project assignments, and contact lists that link online handles to real-world identities. Attackers piece these fragments together into identity chains that reveal where you live, which schools your children attend, and which gaming platforms your family uses. Once mapped, this information fuels doxxing campaigns, targeted phishing, and extortion attempts that feel personal because they are. A single breach like PHI Studio’s can therefore expose not only adults but also the gaming accounts children use, turning a corporate incident into a household threat.