Epicure Listed by metaencryptor Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On August 16, 2023, the organisation Epicure was listed by the ransomware group metaencryptor. Public reporting states that internal files were exfiltrated in a ransomware attack. The number of people affected remains unknown, and further operational details have not been disclosed.

The listing itself is a claim by the group. For customers, staff, and partners of an online healthy-eating retailer, any confirmed exposure of internal material can carry lasting practical consequences, which is why the limited facts that are available deserve clear examination.

Breaking down the breach

According to the available record, Epicure appeared on metaencryptor’s leak site on or around August 16, 2023. The sole concrete description of the incident is that internal files were allegedly exfiltrated during a ransomware attack. No public figure has been given for the volume of data, the precise date the intrusion began or ended, the initial access method, or whether any ransom demand was paid or refused. The number of individuals whose information may have been involved is listed as unknown. Beyond the group’s claim that it holds internal files, independent confirmation of the full scope has not been published in the material provided.

Who is metaencryptor?

metaencryptor is a ransomware operation that has appeared in public threat reporting as a group that encrypts victim systems and simultaneously exfiltrates data, then pressures organisations by threatening to publish the stolen material on a dedicated leak site. Like many contemporary ransomware actors, it typically advertises victims after an intrusion rather than before, using the listing itself as leverage. Public documentation of the group emphasises double-extortion tactics—encryption plus data theft—rather than purely destructive wiper activity. No statements attributed to metaencryptor beyond the bare listing of Epicure are contained in the facts of this incident; any specific claims the group may have made about file counts, sample data, or deadlines therefore remain unverified here and should be treated as assertions rather than established fact.

Epicure and its sector

Epicure is described as an online shop focused on healthy eating, with a primary emphasis on educating the community about nutrition and related products. Public summary information places its revenue at $117 million for the year 2021. Organisations in this sector commonly operate e-commerce platforms, subscription or loyalty programmes, content and recipe libraries, supplier relationships, and internal administrative systems. They routinely hold customer account details, order histories, payment-related records, employee information, and proprietary business documents. A breach affecting such an entity is consequential because the same systems that support everyday commerce and education also concentrate personal and commercial data that can be misused if it leaves the organisation’s control.

What was likely exposed

The facts state only that internal files were exfiltrated. No inventory of specific data types—such as customer names, email addresses, payment card data, employee records, or proprietary recipes—has been published. Organisations of Epicure’s type typically maintain:

• Customer account and contact information tied to online orders
• Order and transaction histories
• Employee and contractor records
• Internal business, supplier, and operational documents

Whether any or all of these categories were among the files taken remains unconfirmed. Readers should treat the exact contents as undisclosed until corroborated by the organisation or by independent forensic reporting.

The real-world impact

For individuals, the principal risks are secondary misuse of any personal data that may have been included among the internal files—phishing that references real order or account details, credential-stuffing attempts if passwords or emails were stored, and longer-term identity or financial fraud if richer identity documents were present. Because the scale and precise contents are unknown, it is not possible to quantify how many people face elevated risk. For the organisation, consequences can include operational disruption from the ransomware event itself, regulatory notification duties where personal data is involved, reputational damage among customers who value trust in a health-oriented brand, and the cost of investigation and remediation. None of these outcomes has been publicly detailed in the available facts; they remain the ordinary range of effects observed after similar incidents.

What to do if you're exposed

If you have an account, subscription, or employment relationship with Epicure, treat the incident as a prompt to review your exposure rather than as proof that your specific data was taken. Change passwords on the Epicure site and on any other accounts that reused the same credentials. Enable multi-factor authentication wherever it is offered. Monitor bank and card statements for unfamiliar charges and place fraud alerts if you believe financial data could have been involved. Be alert to phishing messages that reference healthy-eating orders, deliveries, or account issues. You can also run a free exposure scan of your email address to check whether it has already appeared in known breach datasets. Keep records of any suspicious contact and report confirmed fraud to the relevant financial institution and local authorities. Official updates, if released by Epicure, should be read carefully for confirmation of what was actually affected.

AICompiled with AI assistance from public sources and published under our editorial standards.