DOONEY.COM Listed by clop Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On November 21, 2025, the ransomware group clop listed DOONEY.COM on its leak site and claimed to have exfiltrated internal files. No confirmed count of affected individuals has been released, and the organization has not issued a public statement detailing the scope or method of the incident. Ransomware operations that combine encryption with data theft remain a persistent feature of the current threat environment, with groups publishing victim names to increase pressure for payment.

Breaking down the breach

The only confirmed public information is the listing itself on November 21, 2025. The group states that internal files were removed during a ransomware attack. No further details on the date of intrusion, the volume of data, the encryption status of systems, or any ransom demand have been disclosed. The number of people whose information may be involved is listed as unknown.

The group behind it: clop

Clop is a ransomware operator that has conducted multiple campaigns since at least 2019. Its typical pattern involves initial access through exploited vulnerabilities or compromised credentials, followed by data exfiltration and deployment of ransomware. The group maintains a leak site where it lists organizations and threatens to publish stolen files if demands are not met. Prior activity attributed to clop has included incidents in retail, manufacturing, and professional services. The listing of DOONEY.COM constitutes the group’s claim; independent confirmation of the data’s authenticity or the attack’s details has not been made public.

About DOONEY.COM

DOONEY.COM operates as the official online store for Dooney & Bourke, an American company founded in 1975 that designs and sells leather goods including handbags, wallets, and related accessories. The site handles customer transactions, account creation, and order processing for a consumer retail brand. Organizations in this sector routinely collect names, addresses, payment details, and purchase histories, making them attractive targets for data theft that can be used for fraud or resale.

What data was at risk

The listing refers only to “internal files” without specifying contents. Public reporting has not confirmed whether customer records, employee data, financial information, or other categories were included. In the absence of verified disclosure, the precise categories of personal or corporate information remain unconfirmed.

What's at stake

Individuals whose details appear in stolen files could face increased risk of account takeover or targeted fraud if the material contains login credentials or payment information. For the organization, exposure of internal documents may reveal operational procedures or supplier relationships that could be exploited by competitors or other threat actors. The long-term effects depend on the actual data involved and any subsequent misuse, both of which are currently unknown.

What to do if you're exposed

Anyone who has created an account on DOONEY.COM or made purchases through the site should treat the incident as a reason to review their online security posture even though the exact data at issue has not been confirmed.

• Change passwords for the DOONEY.COM account and any other sites where the same credentials were reused.
• Enable multi-factor authentication on accounts that support it, especially those linked to payment methods.
• Monitor bank and credit-card statements for unauthorized charges and consider placing a fraud alert with credit bureaus.
• Run a free exposure scan of your email address against known breach data to check for additional appearances.

AICompiled with AI assistance from public sources and published under our editorial standards.