formanmills.com Listed by Cactus Ransomware Group

On February 6, 2025, retailer Forman Mills appeared on the leak site of the Cactus ransomware group. The company, which operates dozens of warehouse-style stores selling off-price apparel for men, women, and children, may have had internal files stolen during a ransomware attack. Public reporting indicates the number of people whose information was exposed remains unknown.

What Public Reporting Shows

Forman Mills was founded in 1977 and has grown into a nationwide chain with annual revenue of roughly $422.2 million. The breach involved exfiltration of internal files; available reporting does not list specific customer records such as names, payment details, or Social Security numbers. The data was posted on the Cactus ransomware group’s onion site, with a publicly accessible proof link. No ransom demand deadline has been publicly confirmed in connection with the February 6 listing.

Why This Matters for You and Your Family

When a retailer like Forman Mills suffers a breach, the information stolen can include employee records, vendor contracts, or customer details collected during purchases or loyalty programs. If your family has shopped there, returned items, or applied for a job, your contact information may now sit in a folder controlled by attackers. That data rarely stays isolated. One exposed email or phone number becomes the starting point for phishing texts, fake account-recovery emails, or more aggressive identity theft attempts aimed at your household.

Children’s information is especially vulnerable in retail breaches because family accounts often link parent and child details. A single leak can give criminals enough to open fraudulent accounts or target your family with personalized scams.