TaylorMade & Sun Day Red golf Listed by ExfilSquad Ransomware Group

On July 26, 2026, golf equipment manufacturer TaylorMade and its lifestyle brand Sun Day Red were listed on the leak site of the ransomware group ExfilSquad. The company, which generates roughly $1.5 billion in annual revenue, is named in the listing as having suffered a ransomware attack in which internal files were allegedly exfiltrated. The leak-site listing does not specify the exact number of affected individuals, though the exposed material is reported to contain data on approximately 2 million records.

Reported Details from the Listing

The primary disclosure on the ExfilSquad leak site states that the actor obtained internal files during a ransomware incident. The data summary lists significant PII, customer support history, orders, shipping information, business account data, financial and account information, internal notes, attachments, and AI support chat transcripts. The notification does not quantify the precise number of impacted customer or employee records, nor does it disclose the ransom demand or whether any data has been publicly released beyond the initial listing. Public reporting on similar ExfilSquad postings indicates the group typically provides proof-of-exfiltration samples before moving to full data publication or extortion if payment is not received.

Why This Matters for You and Your Family

If you have ever purchased TaylorMade clubs, apparel, or Sun Day Red products, ordered custom fittings, contacted customer support, or created an account on their sites, your personal information may now sit in an attacker-controlled archive. Shipping addresses, payment details, order histories, and support conversations that often contain dates of birth, phone numbers, or additional identifiers create a rich profile. For families this risk extends beyond the primary account holder: children’s junior golf memberships, shared family addresses, and linked email accounts can all be pulled into the same dataset. Once this volume of structured customer data leaves corporate control, it rarely stays contained.

Doxxing and Identity-Chain Risks

The combination of PII, order history, support transcripts, and financial notes allows attackers to build detailed identity chains. A single leaked email or phone number can be cross-referenced with data from previous breaches to link gaming usernames, social-media handles, children’s school activities, and home addresses. Credential material or support notes that mention passwords or security questions accelerate account takeovers elsewhere. Public reporting shows that ransomware groups and their downstream buyers increasingly use these chains for spear-phishing, SIM-swapping, or direct extortion against individuals. Gaming accounts belonging to you or your children are particularly vulnerable because the same email or reused password often protects both retail purchases and online game profiles.

ExfilSquad’s Known Track Record

Public reporting attributes ExfilSquad with emerging in late 2024 as a double-extortion operation that emphasizes data theft over encryption. The group has targeted mid-to-large retail, manufacturing, and consumer-goods companies. Its typical playbook begins with initial access through compromised credentials or exploited remote services, followed by extensive internal reconnaissance, data exfiltration, and then publication on its leak site when victims do not pay. Notable prior victims have included other sporting-goods and lifestyle brands, though exact success rates remain unclear. The group’s naming convention and site layout suggest it is either a rebrand or close affiliate of earlier operations focused on rapid data dumps rather than prolonged negotiation.

What to do

• Run a DoxxScan to map every link between your email addresses, phone numbers, handles, and real-world identity, then use the cleanup to remove what you can.
• Rotate any password you ever used on TaylorMade or Sun Day Red websites and enable 2FA with an authenticator app everywhere that password was reused.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure of your data is caught in hours rather than months.
• Cover the entire household with DoxxScan family protection, which extends to dependents and children’s gaming accounts that often chain back to the same addresses and emails exposed in retail breaches.
• Let DoxxScan remediation specialists manage takedown requests for any newly surfaced personal documents or chat logs appearing on data-broker and extortion sites.

The incident demonstrates once again that a single retail breach can quietly feed long-term identity abuse against ordinary customers and their families. Staying ahead requires more than reactive checks; it demands continuous visibility and expert intervention. DoxxScan by GalaxyWarden delivers exactly that through continuous monitoring across 13.1 billion+ breach records and over 100 platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that includes children’s gaming accounts.