ddecor.com Listed by BrainCipher Ransomware Group

On May 5, 2025, the ransomware group BrainCipher added ddecor.com to its leak site, claiming that it had exfiltrated internal files from the Indian home-decor manufacturer during a ransomware attack.

What Public Reporting Shows

Public reporting indicates that BrainCipher claims to have stolen internal company documents from D’Decor, a firm known for curtains, upholstery fabrics, bed and bath linens. The exact number of people whose personal information appears in the files remains unknown. No sample data has been publicly released on the leak site, and the attackers have not disclosed a specific volume of records. The incident follows the group’s standard pattern of encrypting victim systems, exfiltrating selected files, and later publishing proof of the theft on its dark-web portal.

Why This Matters for You and Your Family

When a company that sells directly to consumers suffers a breach, the stolen files often contain names, addresses, phone numbers, email accounts, and payment details of ordinary customers. If your family has ever ordered curtains, bedding, or fabric samples from D’Decor or its retail partners, your information could be sitting in those exfiltrated archives. Internal files from retailers frequently include order histories that link household addresses to family members, creating a single point of reference that criminals can use for identity theft, phishing, or physical scams. Even if you cannot remember buying from the brand, shared payment processors or marketing partnerships may have placed your data in the same systems.

The Doxxing and Identity-Chain Risk

A single leaked order record can anchor an identity chain. Criminals combine the exposed email, phone number, and home address with usernames found on gaming platforms, social media, or older breaches. That chain often leads to children’s accounts, where usernames and shared family passwords become gateways for doxxing or account takeovers. Credential leaks like this one routinely cascade into gaming platforms because families reuse passwords across shopping sites and Roblox, Minecraft, or Steam accounts. Once attackers control a child’s gaming profile, they can extract further personal details or demand ransom from worried parents.

BrainCipher’s Known Track Record

Public reporting attributes the group’s emergence to late 2024. BrainCipher has targeted mid-sized retailers, manufacturers, and service companies, typically gaining initial access through phishing or unpatched remote-desktop services. After encryption, the group exfiltrates documents that include customer databases, employee records, and financial spreadsheets. Its playbook relies on a short extortion window followed by public listing on its leak site if payment is not received. The addition of ddecor.com fits this pattern exactly.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, then use the cleanup to remove what you can.
• Rotate any password you ever used on ddecor.com or its retail partners, and enable 2FA through an authenticator app everywhere that password was reused.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next leak exposing your family is caught in hours rather than months.
• Cover the household with DoxxScan family protection that extends to dependents and children’s gaming accounts tied to the same address or credentials.
• Let remediation specialists handle takedown requests across data brokers and exposed profiles that surface after this incident.

The incident shows that even a single retailer breach can quietly expand into long-term identity and doxxing exposure for ordinary families. Starting with a DoxxScan gives you both an immediate map of your exposure and ongoing protection that includes hands-on remediation by specialists and household coverage for every family member. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, and direct specialist support that can interrupt these cascading risks before they reach your home or your children’s gaming accounts.