Filabé Listed by spacebears Ransomware Group: Ransomware Claim — What’s Alleged & What To Do
Filabé was listed by the spacebears ransomware group on 26 May 2026, with internal files reported as exfiltrated from an undisclosed number of people. Anyone connected to the organisation should check whether their data was exposed and take protective steps.
On May 26, 2026, the ransomware group spacebears listed Filabé, a Swiss skincare company, on its leak site. The listing states that internal files were exfiltrated during a ransomware attack. No confirmed count of affected individuals has been released, and details on the method of intrusion or the volume of data remain undisclosed at this time.
Incidents of this kind occur against a backdrop of sustained ransomware activity targeting mid-sized commercial organisations that hold personal and financial records. When such listings appear, they prompt questions about data handling practices and the downstream effects on employees and customers whose information may now circulate in criminal channels.
Inside the incident
The only confirmed public information is the May 26, 2026 listing by spacebears. The group claims to have obtained internal files from Filabé. The number of people affected, the precise date of the intrusion, and the attack vector are not stated in available reporting. No ransom demand amount or confirmation of data publication has been independently verified.
The group behind it: spacebears
Spacebears is a ransomware operator that maintains a public leak site to pressure victims. The group typically exfiltrates data before encryption and lists organisations that do not meet its demands. Its activity follows patterns seen in other ransomware operations that combine file theft with encryption to create leverage through the threat of disclosure.
About Filabé
Filabé is a Swiss company that develops and sells skincare products based on additive-free formulations developed with dermatologists and pharmacists. The firm received a PETA Award for Best Vegan Innovation in 2025. Companies in this sector routinely process customer order data, employee records, and financial documentation related to product development and sales.
What data was at risk
The listing refers to internal files. Available information indicates that the material claimed to have been taken includes personal information of employees and clients, financial documents, and other files. The exact scope and sensitivity of the contents have not been confirmed by the company or by independent investigation.
The real-world impact
Individuals whose personal details appear in the exfiltrated material may face risks of targeted phishing or identity misuse. The organisation may incur costs related to investigation, notification, and remediation. Because the number of records and the verification status of the data remain unknown, the scale of these consequences cannot yet be quantified.
Were you affected?
Begin by monitoring official statements from Filabé for any notification process. Review bank and credit statements for unusual activity and consider placing fraud alerts with relevant financial institutions if personal identifiers were involved. Readers can run a free exposure scan of their email address against known breach data sets to check for prior appearances in public listings.
- Change passwords for any Filabé-related accounts and enable multi-factor authentication where available.
- Watch for unsolicited messages that reference the company or recent orders.
- Keep records of any correspondence from the company regarding the incident.
AICompiled with AI assistance from public sources and published under our editorial standards.
How this breach connects
More recent breaches
Elixi International SA Listed by spacebears Ransomware GroupSpaceBears Ransomware Hits Italian Manufacturer BiesSseFitcrunch Listed by spacebears Ransomware GroupBlenheim Listed by spacebears Ransomware GroupLatest breaches
Read GalaxyWarden’s full analysis of the Filabé Listed by spacebears Ransomware Group →
Publicly posted by spacebears — unverified claim, pending independent verification
Breach listings — particularly those originating from ransomware or leak sites — are third-party claims that may be unverified, incomplete, or inaccurate. A listing does not by itself confirm that a breach occurred or that any specific data was exposed. Severity is an automated assessment, not a definitive rating. Verification status is shown where available.
Attributions to threat groups and methods reflect public reporting and, in some cases, unverified claims made by the groups themselves; they may be incomplete or later revised. Recent Breaches and GalaxyWarden are independent and are not affiliated with, and do not endorse, any company or group named on this page. This information is aggregated from public sources for awareness only and is not legal, security, or investment advice.