Elgon Cosmetic Listed by spacebears Ransomware Group

On January 20, 2026, Italian hair-care manufacturer Elgon Cosmetic appeared on the leak site of the spacebears ransomware group. The listing indicates that internal company files were exfiltrated during a ransomware attack. Public reporting shows the exposed material includes customer data, personal user data, medical records, company financial reports, and product formulas.

Reported Details of the Breach

Elgon Cosmetic, founded in 1970 and based in Italy, supplies professional hair-care products to salons worldwide. The company’s own website confirms its long-standing presence in the beauty sector. Available reporting describes the incident as a ransomware attack in which attackers copied internal documents before encrypting systems. The data set listed on the spacebears leak site contains customer data, medical records, financial reports, and product formulas. The exact number of individuals affected remains unknown.

The primary source is the spacebears leak page hosted on an onion domain and indexed by ransomware.live. No independent verification of the full data volume has been published, and secondary sources are limited.

Why This Matters for You and Your Family

When a salon or beauty supplier suffers a breach, the people whose information ends up in the stolen files are ordinary customers who booked appointments, bought products, or provided contact details. If your name, address, phone number, or payment information was stored by Elgon Cosmetic or any salon that uses their systems, that information may now be in the hands of criminals. Medical records and personal user data increase the risk of identity theft, insurance fraud, or targeted scams against you or members of your household.

Children and teenagers who visit salons or whose parents shared family details may also be exposed. A single leak like this can give attackers enough pieces to impersonate family members, open accounts, or launch phishing campaigns that feel personal because they reference real purchase history or health information.

The Doxxing and Identity-Chain Risks

Ransomware groups rarely stop at posting one company’s files. Once customer records appear on a leak site, they often circulate through underground forums where other criminals combine them with data from previous breaches. An email address allegedly taken from Elgon Cosmetic can be matched to gaming accounts, social-media handles, or school records. This creates an identity chain that leads from a hair-product purchase to your full online life. Credential leaks of this kind frequently cascade into account takeovers, especially for gaming platforms used by children, where the same password or recovery email has been reused.

Personal user data and customer data are particularly dangerous because they often include phone numbers and physical addresses. Attackers can use these to launch SIM-swapping attempts, send extortion messages, or sell the information on doxxing marketplaces. What begins as a salon’s supplier breach can quickly become a household privacy problem.

Spacebears Ransomware Group Track Record

Public reporting attributes the attack to the spacebears ransomware group. The group emerged in late 2024 and has targeted mid-sized companies across Europe and North America. Notable prior victims include manufacturing firms, retailers, and professional-services providers. Their typical playbook involves initial access through phishing or exploited remote-desktop services, followed by exfiltration of sensitive files, deployment of ransomware, and later publication of stolen data on their leak site if the victim does not pay. Extortion demands usually combine threats of data release with offers to delete the files upon payment. Reporting indicates they focus on companies that handle consumer information but are not always quick to encrypt every system, preferring to exfiltrate first.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, handles, and real-world identity so you can see exactly what chains back to the Elgon Cosmetic breach.
• Rotate any password you used when purchasing from Elgon Cosmetic or affiliated salons, and enable 2FA through an authenticator app on every account where that password was reused.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next time your information surfaces you learn within hours rather than months.
• Cover the household with DoxxScan family protection that extends to dependents and children’s gaming accounts, which often become targets when credential leaks create doxxing chains.
• Let remediation specialists handle takedown requests for any personal records that appear on data-broker sites or underground forums connected to this incident.

The Elgon Cosmetic breach is a reminder that data belonging to ordinary customers can surface on ransomware leak sites with little warning. Taking concrete steps now limits how far attackers can travel down the identity chain that begins with a single supplier breach. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and household coverage that includes children’s gaming accounts.