FRUIT.COM Listed by clop Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On November 21, 2025, the Clop ransomware group listed FRUIT.COM on its leak site and claimed responsibility for a ransomware attack that resulted in the exfiltration of internal files. The number of individuals whose information may be involved is not publicly known, and the company has not confirmed the incident or released details about the scope of any data access. The practical implications for customers and staff depend on what the files contained. Without further disclosure, those who placed orders, supplied contact information, or maintained business relationships with the company cannot yet assess their specific exposure.

Breaking down the breach

The only confirmed public information is the listing itself. Clop posted FRUIT.COM on its site on November 21, 2025, and stated that internal files had been taken during a ransomware operation. No figures for the volume of data, the number of records, or the timeline of the intrusion have been released. The company has not issued a statement confirming or denying the claim.

Who is clop?

Clop is a ransomware group that has conducted operations since at least 2019. It is known for encrypting systems and then threatening to publish stolen data if a ransom is not paid. The group maintains a leak site where it lists organizations it claims to have targeted. Its activity has been tracked by multiple cybersecurity researchers and law-enforcement agencies, though specific claims about any single victim require independent verification.

FRUIT.COM and its sector

FRUIT.COM operates as an online retailer that sells and delivers fresh fruit arrangements, chocolate-dipped fruit, and related gift items. The business model relies on direct shipping to customers, which typically involves collection of names, addresses, payment details, and order histories. Companies in the perishable-goods e-commerce sector routinely store customer records, supplier information, and internal operational documents to manage inventory and deliveries.

What was likely exposed

The listing refers only to “internal files exfiltrated in ransomware attack.” No inventory of specific data types has been published. Organizations of this kind commonly hold customer names, shipping addresses, email addresses, and transaction records, as well as employee or vendor files. The exact contents of the exfiltrated material remain unconfirmed.

Why it matters

Exposure of internal files can create downstream risks such as targeted phishing, account takeover attempts, or misuse of personal details for fraud. For the company, the incident may affect customer trust and require investigation and remediation costs. Because the scale of the data and the identity of affected individuals are not yet known, the full consequences cannot be measured at present.

What to do if you're exposed

Monitor email and postal addresses associated with any orders placed with FRUIT.COM for unusual activity. Enable multi-factor authentication on accounts that share the same credentials or recovery information. Review bank and credit-card statements for unauthorized transactions. Individuals can run a free exposure scan of their email address against known breach data to check whether their information appears in publicly reported incidents.

AICompiled with AI assistance from public sources and published under our editorial standards.