Coswell Listed by metaencryptor Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On 16 August 2023, the Italian company Coswell appeared on a listing associated with the ransomware group metaencryptor. Public detail is limited: the number of people affected is unknown, and the only description of what was taken refers to internal files said to have been exfiltrated in a ransomware attack. For employees, partners, suppliers, and anyone whose details may sit inside those systems, the practical question is whether personal or commercial information has left the organisation’s control and what that could mean in ordinary life—identity misuse, targeted fraud, or unwanted contact.

Because the listing is a claim by the group rather than an independently confirmed disclosure from Coswell, the full scope remains unconfirmed. What is known is enough to take the incident seriously and to check whether your own details have appeared in known breach data.

What happened

According to the reported record, Coswell was listed by the metaencryptor ransomware group on 16 August 2023. The summary states that internal files were exfiltrated in a ransomware attack. No public figure has been given for the number of people affected. Timing of the underlying intrusion, the method of initial access, the volume of data, and any ransom demand or payment outcome are not disclosed in the available facts. The incident is therefore documented principally as a leak-site listing and a high-level description of file exfiltration, not as a fully detailed forensic account.

Who is metaencryptor?

metaencryptor is a ransomware operation known in public reporting for encrypting victim systems and for the common double-extortion pattern: copying data before encryption and threatening to publish or sell it if demands are not met. Groups of this type typically maintain dedicated leak sites where they name organisations, sometimes post samples, and set deadlines. Their activity has been tracked across multiple sectors and countries; they are not limited to one industry. In this case, the group’s listing of Coswell should be treated as its claim. The facts do not state that Coswell has independently confirmed every detail of the group’s assertions, nor do they quote specific statements metaencryptor made about this victim beyond the fact of the listing and the description of internal files exfiltrated.

Who is Coswell?

Coswell is described as an Italian family-run group of companies specialised in the manufacturing and distribution of body and oral care products, health foods, masstige and selective fragrances, skin care and cosmetics. Its channels include the mass market, perfumeries and pharmacies. Reported revenue for 2021 was $157 million. Organisations of this kind typically maintain systems for product development, manufacturing, logistics, wholesale and retail relationships, finance, and human resources. A breach involving internal files can therefore touch commercial contracts, employee records, supplier data, and customer or partner information held for distribution and marketing—even when the exact contents of a particular incident remain unconfirmed. Because Coswell operates across consumer health and beauty categories in Italy and related markets, disruption or data exposure can affect both the business and the people connected to it through employment, supply, or trade.

The information in question

The facts name the exposed material as internal files exfiltrated in a ransomware attack. No further breakdown—such as whether the files included customer lists, employee identifiers, financial documents, formulas, or partner contracts—is provided. People affected are listed as unknown. For a manufacturer and distributor in personal care and related goods, internal repositories commonly hold personnel data, invoices, shipping and customer account details, product and pricing information, and correspondence. None of those categories should be assumed present in this incident; they illustrate only what such organisations often store. Exact contents in the Coswell case remain unconfirmed.

Why it matters

When internal files leave an organisation in a ransomware event, the risks are concrete rather than abstract. Individuals whose names, contact details, or identification numbers appear in those files may face phishing that looks legitimate because it uses real context, attempts at account takeover, or longer-term identity fraud. Suppliers and trade partners may see commercial terms or operational data misused. The organisation itself faces operational disruption, regulatory and contractual obligations, and the cost of investigation and remediation. Because the scale is undisclosed, it is not possible to say how many people sit in the affected set; the prudent stance is to treat any plausible connection to Coswell’s systems as a reason to monitor accounts and communications. Attribution rests on the group’s claim of listing and exfiltration; independent public confirmation of every technical detail is not part of the given record.

What to do if you're exposed

If you believe you may be connected to Coswell as an employee, partner, supplier, or customer, take measured steps while public detail remains limited.

• Watch bank, email, and shopping accounts for unfamiliar logins or messages that reference Coswell or related brands in a way that pressures you to click or pay.
• Change passwords on important accounts, especially if you reused any credential tied to work or supplier portals, and turn on multi-factor authentication where it is offered.
• Treat unexpected invoices, delivery notices, or “security” alerts with caution; verify through a known official channel rather than links in the message.
• If you are an employee or contractor, follow any guidance Coswell issues and report suspicious contact to the appropriate internal team.
• Consider placing fraud alerts or credit monitoring where that is available in your country, and keep records of any odd activity.
• You can run a free exposure scan of your email to check whether your information has already surfaced in known breach data sets.

These steps do not depend on knowing the full file inventory. They reduce the chance that a limited, still-unconfirmed exposure turns into lasting harm. Stay alert to official updates from Coswell or relevant authorities rather than relying solely on claims posted by the threat group.

AICompiled with AI assistance from public sources and published under our editorial standards.