Back to Blog
high severity June 02, 2026 · scope unconfirmed

Ingka Group (IKEA) Targeted in Alleged Lapsus$ Data Theft

Lapsus$ claimed to have stolen and is offering for sale around 180 GB of internal data from Ingka Group, the largest IKEA franchisee. The alleged theft includes source code and technical documents. Ingka confirmed it is investigating the claims, which were widely reported in early June.

⚠ Were you affected?
Free email scanner — we check your address against 15.4B+ leaked records in 15 seconds.
Run free scan →
Ingka Group (IKEA) Targeted in Alleged Lapsus$ Data Theft
Data exposed:
  • source code
  • technical documents
  • internal data

On June 2, 2026, the hacking group Lapsus$ claimed responsibility for stealing roughly 180 GB of internal data from Ingka Group, the largest franchise operator of IKEA stores worldwide. The group said the material includes source code, technical documents, and other internal files, and offered the data for sale. Ingka Group stated it is actively investigating the claims.

Public reporting indicates the incident follows Lapsus$’s pattern of high-profile data thefts followed by extortion or sale. Available details show that the exact number of individuals whose personal information may have been exposed remains unknown. Ingka has not yet confirmed that customer records were taken, but the volume and nature of the stolen material have raised concerns that employee, supplier, or customer data could be included. Industry research from sources such as DoxxScan™ continuous monitoring indicates that retail and logistics breaches frequently surface employee emails, internal credentials, and partner contact lists in subsequent leaks.

You've read 2 of 2 free articles today — reset tomorrow.

Want the rest of this breakdown?

Sign up free to keep reading. Members get extended access, the weekly breach digest, and a complimentary Warden™ to see if their identity is exposed in the breaches we cover.

Full breach archive
Weekly threat digest
30 days of Warden Plus included
Why this isn’t just another breach checker

A breach leaks your credentials. Then hackers chain those credentials to your address, family, phone, and employer using public broker sites. We’re the only tool built around that chain.

Free checker Tells you the breach happened. End of story. You’re still on 800+ broker sites.
$129+/yr Broker-removal services scrub the address but don’t see the breach — next leak re-exposes you.
GalaxyWarden Maps the chain. Cleans both halves. $19 one-shot. Closed loop.

⚠ Were you in this breach?

Free email scanner. We check your address against 15.4B+ leaked records in 15 seconds — then show you the $19 cleanup that removes you from the broker sites aggregating leaked data.

Check my email — free →
Close the chain attack

Both halves of the chain, cleaned once.

A breach put your credentials in 15.4B+ leaked records. Hackers chain that data to your address on 800+ broker sites. GalaxyWarden closes both halves for $19 once — no subscription required.

Clean both halves — $19 →
Free breach scan + 800+ broker letters + 30-day proof · one payment, no subscription
W Warden Plus — ongoing monitoring $9.99/mo
Warden Plus ($9.99/mo or $99/yr): weekly re-scans, breach alerts, AI Concierge, auto re-files on relisted brokers.