Radley and Co Listed by ransomhouse Ransomware Group

On August 29, 2023, British accessories brand Radley and Co appeared on the leak site operated by the ransomhouse ransomware group. The listing states that internal files were exfiltrated during a ransomware attack on the London-headquartered company, which designs and manufactures handbags, purses and other women’s accessories sold in the UK and internationally. The disclosure does not quantify how many customer or employee records were affected, nor does it list specific data types beyond the broad description of internal files.

Details from the Leak Site

The ransomhouse listing, still accessible via its onion address as of the initial publication date, claims successful data exfiltration from Radley and Co. It follows the group’s standard format of naming the victim, posting a sample of allegedly stolen material, and setting an implicit deadline for payment before full publication. The primary disclosure indicates that the files were taken after the company’s systems were encrypted, a common ransomware pattern where operators first steal data and then threaten both encryption and public release. No ransom amount is stated in the public listing, and it remains unclear whether any negotiation occurred.

Why This Matters for You and Your Family

When a retailer like Radley and Co suffers a breach, the information exposed often includes customer details gathered during purchases, returns, or loyalty-program sign-ups. Even though the exact contents are not detailed, internal files exfiltrated in ransomware attack frequently contain names, addresses, email addresses, phone numbers, and payment card information. If your family has ever bought a Radley handbag, purse, or accessory, your contact details may now sit in an attacker-controlled archive. That data can be sold quietly on underground forums long after the initial leak-site posting disappears, creating years of exposure for you and anyone whose information was linked to the same account.

Doxxing and Identity-Chain Risks

Stolen customer files rarely stay isolated. Attackers combine them with other breaches to build detailed profiles that link email addresses, phone numbers, partial payment data, and physical addresses. These identity chains allow criminals to reset passwords on shopping accounts, loyalty programs, or even email, leading to further theft and harassment. For families, the risk extends to children whose names or school-related details sometimes appear in parental purchase records. A single exposed address can tie together your online handles, gaming accounts, and family members’ profiles, turning one retail breach into a gateway for doxxing campaigns or targeted social-engineering attacks.

RansomHouse’s Known Track Record

Public reporting attributes the emergence of RansomHouse to late 2021. The group has targeted organizations across retail, healthcare, manufacturing, and professional services, often listing victims on its dark-web portal after double-extortion attempts. Its typical playbook involves initial access through compromised credentials or vulnerable remote-desktop services, followed by lateral movement to locate valuable data, exfiltration over several days, and deployment of ransomware to encrypt systems. RansomHouse then demands payment to prevent both decryption failure and data publication. While not the most prolific ransomware operation, its steady activity and willingness to follow through on leaks make any appearance on its site a serious signal.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, using cleanup of Warden where possible.
• Rotate any password you have reused at Radley and Co or similar retail sites, then enable 2FA through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure surfaces in hours instead of months.
• Cover the household with DoxxScan family coverage that extends to dependents and children’s gaming accounts that often chain back to the same address or parental email.
• Let remediation specialists handle takedown requests across data brokers and leak sites on your behalf while you focus on securing day-to-day accounts.

The Radley and Co incident illustrates how retail breaches continue to feed the ransomware economy and create persistent identity risks for ordinary customers. A short period of focused action now can limit how far this particular leak travels. DoxxScan by