Sunstar Americas Listed by royal Ransomware Group

On March 30, 2023, dental-product manufacturer Sunstar Americas appeared on the leak site operated by the Royal ransomware group. The listing states that attackers exfiltrated roughly 118 GB of internal files during a ransomware incident and warns that the data, which includes customer personal information, will soon be published for anyone to download.

Details in the Leak-Site Listing

The Royal leak page explicitly names Sunstar Americas, a subsidiary of Sunstar Corporation known for oral-care brands, and states the company was hit by a ransomware attack that resulted in data exfiltration. It does not specify the exact number of individuals whose records were taken, nor does it list every file type exposed. The disclosure indicates the stolen archive contains both customer personal information and other internal corporate data. A countdown timer and sample screenshots were posted to pressure the company, a standard part of the group’s playbook. The primary source remains the onion link hosted on the Royal site, indexed by ransomware.live.

Why This Matters for You and Your Family

If you or anyone in your household has ever bought Sunstar toothpaste, floss, interdental brushes, or other dental products directly from the company or through one of its retail partners, your contact details, purchase history, or payment-related records may now sit inside that 118 GB archive. Even basic personal information such as names, addresses, phone numbers, and email addresses can be combined with data from previous breaches to build a detailed profile. For families this risk extends beyond the primary account holder: children’s names or school-related purchases sometimes appear in customer databases, creating long-term exposure that follows them into adulthood.

The Doxxing and Identity-Chain Risk

Customer records from a consumer-products company like Sunstar are rarely isolated. A single leaked email or phone number can be matched to gaming accounts, social-media handles, or school records, allowing attackers to map an entire household. Public reporting on similar incidents shows that ransomware operators increasingly sell or publish these datasets precisely because they enable follow-on account takeovers and doxxing campaigns. Credential leaks of this kind frequently cascade into children’s gaming accounts that reuse the same email or password, turning one corporate breach into a chain of identity compromises that can span years.

Royal Ransomware Group’s Track Record

Public reporting attributes the Royal ransomware group’s first major campaigns to late 2022. Since then the group has listed dozens of organizations across manufacturing, healthcare, and retail sectors. Notable prior victims include companies whose customer or employee data appeared on the same leak site weeks after initial encryption attempts failed. Royal typically gains initial access through phishing or exploited remote-desktop services, exfiltrates data before deploying ransomware, and then runs a double-extortion campaign: demanding payment to prevent both system restoration and public release of the stolen files. The group’s leak site remains active and continues to publish new victims on a regular schedule.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity so you can see exactly what this Sunstar exposure connects to.
• Rotate any password you used at Sunstar Americas or its retail partners and enable 2FA with an authenticator app everywhere that same password appears.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next time your information surfaces you learn within hours rather than months.
• Cover the household with DoxxScan family protection that extends to dependents and children’s gaming accounts that often chain back to the same breached email or address.
• Let remediation specialists handle takedown requests across data brokers and leak sites on your behalf while you focus on securing your own accounts.

The Sunstar Americas listing is a reminder that even routine purchases can place your family’s details on the dark web. Acting quickly on the exposed data before it spreads further is the most practical defense. DoxxScan by GalaxyWarden provides continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, and hands-on remediation by specialists, with household coverage that includes children’s gaming accounts vulnerable to credential-based attacks.