Elgon Cosmetic Listed by spacebears Ransomware Group: Ransomware Claim — What’s Alleged & What To Do
Elgon Cosmetic was listed today by the spacebears ransomware group after internal files were stolen in a ransomware attack. The number of people affected has not been disclosed; anyone who has dealings with the company should check for notices and take protective steps.
On January 20, 2026, the ransomware group spacebears listed Elgon Cosmetic on its leak site and stated that internal files had been taken from the company. The number of people affected remains unknown, and no further details about the scale or method of the incident have been made public.
Incidents of this kind matter because they can place customer records, employee information, and proprietary business data into circulation. Individuals connected to the company may face follow-on risks such as misuse of personal details or attempts to leverage stolen information for further access.
Inside the incident
The only confirmed detail is the listing itself and the group’s statement that internal files were allegedly exfiltrated during a ransomware attack. No date of compromise, volume of data, or technical method has been disclosed. The organisation has not issued a public statement confirming or denying the claims.
Who is spacebears?
Spacebears is a ransomware operator that follows the common pattern of encrypting systems and copying data before demanding payment. The group maintains a leak site where it lists organisations it claims to have targeted, a tactic used to increase pressure on victims who do not pay. Public records show the group has appeared in multiple incidents involving similar data-exfiltration claims, though each listing remains an unverified assertion until independently confirmed.
About Elgon Cosmetic
Elgon Cosmetic was founded in 1970 in Italy and manufactures professional hair-care products supplied to salons. Companies in this sector routinely store customer contact details, order histories, formulation records, and internal financial information. A breach at such a firm can therefore expose both personal data belonging to clients and commercially sensitive material developed over decades.
What was likely exposed
The group’s listing refers to internal files taken in a ransomware operation. The report also mentions company financial reports, medical records, personal user data, product formulas, and customer data. These categories have not been independently verified, so the precise contents of any exfiltrated material remain unconfirmed.
The real-world impact
People whose information appears in the files may encounter attempts to use their details for account access or fraud. The organisation faces the operational cost of investigating the intrusion, restoring systems, and addressing any regulatory obligations that arise from the handling of personal or sensitive records. Both outcomes unfold over months rather than days.
What to do if you're exposed
Review recent account statements and login activity for any services linked to the company. Enable multi-factor authentication where available and replace passwords that may have been reused. Individuals can also run a free exposure scan of their email address to check whether their information has appeared in known breach data sets.
AICompiled with AI assistance from public sources and published under our editorial standards.
How this breach connects
More recent breaches
SpaceBears Ransomware Hits Italian Manufacturer BiesSseFitcrunch Listed by spacebears Ransomware GroupECOVACS Listed by spacebears Ransomware GroupCattani Listed by spacebears Ransomware GroupLatest breaches
Read GalaxyWarden’s full analysis of the Elgon Cosmetic Listed by spacebears Ransomware Group →
Publicly posted by spacebears — unverified claim, pending independent verification
Breach listings — particularly those originating from ransomware or leak sites — are third-party claims that may be unverified, incomplete, or inaccurate. A listing does not by itself confirm that a breach occurred or that any specific data was exposed. Severity is an automated assessment, not a definitive rating. Verification status is shown where available.
Attributions to threat groups and methods reflect public reporting and, in some cases, unverified claims made by the groups themselves; they may be incomplete or later revised. Recent Breaches and GalaxyWarden are independent and are not affiliated with, and do not endorse, any company or group named on this page. This information is aggregated from public sources for awareness only and is not legal, security, or investment advice.