Coswell Listed by Metaencryptor Ransomware Group

On August 16, 2023, Italian cosmetics and personal-care manufacturer Coswell appeared on the leak site of the metaencryptor ransomware group. The listing states that internal files were exfiltrated during a ransomware attack on the family-run company, which produces body care, oral care, health foods, fragrances, skin care and cosmetics sold through mass-market retailers, perfumeries and pharmacies.

Details in the Leak-Site Listing

The metaencryptor portal lists Coswell as a victim and claims that data was stolen prior to encryption. The disclosure does not quantify how many records were taken, name the specific systems compromised, or list exact file types beyond the generic description internal files exfiltrated. No ransom amount or payment deadline is shown in the public portion of the listing. The entry was first indexed on ransomware.live on August 16, 2023, matching the date the group published the victim.

Why This Matters for You and Your Family

When a company that sells everyday personal-care items suffers a breach, the information stolen can include supplier contracts, customer orders, employee payroll files, or distributor databases. Any of those records may contain names, addresses, phone numbers, email addresses and payment details belonging to ordinary customers and staff. Once that data leaves the company’s control, it can be sold quietly on underground forums long before the public learns of the incident. For families, this means heightened risk of identity theft, phishing campaigns tailored to your recent purchases, or fraudulent accounts opened in your name using details you never expected would leave an Italian manufacturer’s network.

The Doxxing and Identity-Chain Risk

Stolen internal files frequently contain spreadsheets that link customer or employee identities to email addresses, phone numbers, or account handles. Attackers chain these fragments together with data from previous breaches to build complete profiles. A seemingly harmless order confirmation email can be combined with a leaked phone number and a reused password to take over shopping accounts, loyalty programs, or even children’s gaming profiles that share the same family address. These chains accelerate doxxing because one exposed record becomes the bridge that reveals far more than the original breach disclosed.

Metaencryptor’s Known Playbook

Public reporting attributes metaencryptor with emerging in early 2023 as a ransomware-as-a-service operation. The group typically gains initial access through phishing or exploited remote desktop services, exfiltrates data before deploying encryption, then posts victim names on its onion site when negotiations stall. Notable prior targets have included manufacturing and distribution firms across Europe. The group’s standard tactic is to publish a small sample of stolen files as proof and threaten full release or sale if the victim does not pay. In Coswell’s case the listing follows this pattern, although the precise volume and sensitivity of the files remain unknown.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, then use the cleanup of Warden to scrub what you can.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure of your data is caught in hours rather than months.
• Rotate any password you used on Coswell-linked accounts or supplier portals and switch on 2FA through an authenticator app instead of SMS.
• Cover the household with DoxxScan family protection that extends to dependents and children’s gaming accounts, which often chain back to the same home address or parent email.
• Let remediation specialists handle ongoing takedown requests across data brokers and leak sites on your behalf while you focus on securing day-to-day accounts.

The Coswell breach is a reminder that even manufacturers of everyday shampoo and toothpaste hold data that can be weaponized against ordinary families. Start your DoxxScan trial today; its continuous monitoring, AI-powered identity-chain mapping, hands-on remediation by specialists, and household coverage including children’s gaming accounts give you the practical defense needed when the next leak appears.