Swipe.bg Listed by ransomed Ransomware Group

On September 04, 2023, Bulgarian online marketplace Swipe.bg appeared on the leak site of the ransomware group known as Ransomed. The listing states that the attackers successfully exfiltrated internal files during a ransomware incident and are now demanding $50,000 to prevent publication. The disclosure indicates that the stolen material includes userdata, customer chats, SSNs, phone numbers, addresses and additional unspecified records. The exact number of affected individuals remains unknown.

Details in the Leak-Site Listing

The primary disclosure on the Ransomed leak page, archived via ransomware.live, states that attackers gained access to Swipe.bg’s systems and removed internal data. It explicitly lists SSNs, customer chats, addresses, and phone numbers among the exfiltrated material. The posting does not specify the volume of records taken or the precise systems compromised beyond describing Swipe.bg as an online marketplace known for low prices. No proof files or sample data appear to have been published at the time of the initial listing, which is common when a group is still in the negotiation phase.

Why This Matters for You and Your Family

When an marketplace handling everyday purchases suffers a breach, the exposure reaches ordinary shoppers who used their real names, home addresses, and government identifiers. SSNs combined with addresses and phone numbers create immediate risks of tax fraud, loan applications in your name, and persistent spam or phishing campaigns. Customer chat logs can reveal personal details shared during support conversations, such as dates of birth, family member names, or purchase histories that help scammers build convincing pretexts. Because the ransom demand remains unmet, the data could surface publicly at any time, turning a single marketplace purchase into long-term identity exposure for you and anyone whose information you stored in your account.

The Doxxing and Identity-Chain Implications

Leaked SSNs, addresses, and phone numbers serve as anchor points for doxxing chains that link disparate online handles back to real-world identities. Once attackers or opportunistic criminals obtain this core information, they can cross-reference it with credential leaks from other services, gaming platforms, and social accounts. This is precisely why services that map these connections matter. DoxxScan by GalaxyWarden performs continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, applies AI-powered identity-chain mapping, and provides hands-on remediation by specialists. It also covers entire households, including children’s gaming accounts that frequently reuse credentials or linked email addresses and can become entry points for further targeting.

Ransomed Group’s Known Track Record

Public reporting attributes the Ransomed group with emerging in mid-2023 as a relatively new entrant in the ransomware ecosystem. The actors typically deploy double-extortion tactics: they encrypt victim systems and simultaneously exfiltrate sensitive files before threatening to publish the data unless a ransom is paid. Prior victims have included smaller organizations and online service providers where customer personal information formed the core of the leverage. Their playbook often begins with phishing or exploitation of internet-facing applications for initial access, followed by rapid data collection and public shaming on dedicated leak sites when negotiations stall. The group’s exact size and full history remain under active tracking, but its rapid appearance on multiple victim lists in 2023 indicates an aggressive operational tempo.

What to do

• Run a DoxxScan to map every link between your email addresses, phone numbers, handles, and real identity, then use the cleanup of Warden to remove what you can.
• Enable continuous DoxxScan monitoring so the next breach exposing your data is caught in hours rather than months.
• Rotate any password you used on Swipe.bg anywhere else it is reused and switch to 2FA through an authenticator app instead of SMS.
• Cover the household with DoxxScan family protection that extends to dependents and children’s gaming accounts that often chain back to the same addresses and emails.
• Let remediation specialists handle data-broker takedown requests and persistent exposure points on your behalf.

The incident underscores that even smaller e-commerce sites can become high-value targets when they hold government identifiers and contact details. Acting quickly on the personal side limits how far attackers can travel down the identity chain once the data appears. Start your DoxxScan trial and let continuous monitoring plus specialist remediation work for your entire family.