Widdop & Co. Listed by rhysida Ransomware Group

Widdop & Co., a family-owned wholesale gifts and home decor supplier based in the UK, was listed on the Rhysida ransomware group’s leak site on May 18, 2024. The extortion actors claim to have exfiltrated internal files from the company’s Widdop Data System program and SQL databases during a ransomware attack that occurred on April 29, 2024. Anyone whose contact details, order history, or payment information sits inside those supplier and buyer records may now face heightened risk of identity theft, phishing, or fraud.

Reported Details from the Listing

The Rhysida leak site states that the actor obtained the source code of the Widdop Data System along with associated SQL databases. These files reportedly contain contact details for all suppliers and buyers, the company’s financial flows, and the algorithms used to calculate discounts and margins. The listing presents the package as a “turnkey ready-made business” and does not specify the exact number of records involved. The disclosure indicates the data was taken during a ransomware incident on April 29, 2024, with the public listing appearing 19 days later. No ransom demand figure or proof-of-possession samples beyond the sales description have been published on the leak page.

Why This Matters for You and Your Family

If you have ever bought gifts, homeware, or seasonal décor from Widdop & Co. or any of the retailers it supplies, your name, address, phone number, email, and possibly payment details could sit inside the stolen databases. That information is now being offered for sale to other criminals who can combine it with data from dozens of other breaches. The result is a higher volume of convincing phishing emails, vishing calls pretending to be from suppliers or delivery firms, and targeted identity fraud attempts. Even if you are not a direct customer, employees of Widdop & Co. and its trading partners now have their workplace contact data exposed, increasing the chance that spear-phishing emails land in their inboxes and indirectly affect your household.

The Doxxing and Identity-Chain Risks

Business contact databases like these rarely stay isolated. A single email or phone number can be linked to personal accounts across shopping sites, loyalty programs, and social media. Once attackers map those connections they can pursue account takeovers, SIM swaps, or full doxxing campaigns that publish home addresses and family details. Credential leaks of this type also cascade into gaming platforms: children’s accounts frequently reuse the same email addresses or passwords that appear in family purchase records. A compromised Roblox, Fortnite, or Steam login can quickly expose chat logs, friend lists, and further personal information that feeds the next stage of an identity chain.

Rhysida’s Known Track Record

Public reporting attributes the first appearance of Rhysida to mid-2023. The group has since claimed responsibility for attacks on healthcare providers, local governments, and manufacturing firms. Their typical playbook begins with initial access through compromised remote desktop credentials or exploited vulnerabilities, followed by rapid exfiltration of internal file shares and databases before encryption. Rhysida then publishes a sample or full data set on their Tor leak site if the victim does not pay, often framing the stolen material as commercially valuable rather than simply embarrassing. The Widdop & Co. listing follows this exact pattern, presenting the SQL databases and proprietary software as a ready-to-operate business package.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, then use the cleanup of Warden to remove what you can.
• Rotate any password you have used at Widdop & Co. or any supplier listed in the breach, and switch on 2FA through an authenticator app instead of SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure of your data is caught and acted on in hours rather than months.
• Cover the household with DoxxScan family protection that extends to dependents and children’s gaming accounts, which often chain back to the same addresses and emails now circulating.
• Let remediation specialists handle ongoing takedown requests across data brokers and leak sites on your behalf while you focus on securing day-to-day accounts.

The Widdop & Co. breach is another reminder that data stolen from small and midsize suppliers can expose thousands of ordinary customers and their families within weeks. Starting with a clear picture of where your information already appears online gives you the best chance of limiting further damage. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that includes children’s gaming accounts.