Honey Birdette Listed by 8base Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to single out consumer-facing retailers, treating customer databases and internal records as leverage in double-extortion schemes that have become routine across the threat landscape. In late November 2023 one such listing appeared that named the Australian luxury lingerie brand Honey Birdette.

Public reporting states that the 8base ransomware group claimed to have exfiltrated internal files from Honey Birdette. The number of people affected remains unknown, and independent confirmation of the claim has not been published. For customers and staff the episode still warrants attention because even limited internal material can contain personal or transactional details that outlive the initial incident.

What happened

On 28 November 2023 Honey Birdette was listed by the 8base ransomware group. According to the available record the group asserted that internal files had been taken in a ransomware attack. No further technical detail—such as the initial access vector, the precise date of intrusion, the volume of data, or any ransom demand—has been disclosed in the public summary. The number of individuals whose information may have been involved is likewise unconfirmed.

Because the sole source is the group’s own leak-site claim, the incident should be treated as an unverified assertion until Honey Birdette or independent investigators provide corroboration. What is established is simply that the organisation’s name appeared on the 8base listing together with the statement that internal files had been exfiltrated.

The group behind it: 8base

8base is a ransomware operation that emerged in the public eye in 2022–2023 and follows the now-standard double-extortion model. After encrypting systems the group copies data and threatens to publish it on a dedicated leak site if payment is not received. Affiliates typically gain entry through phishing, exploited vulnerabilities or stolen credentials, then move laterally before deploying the ransomware payload.

The group has previously listed organisations across retail, manufacturing, professional services and healthcare. Its leak site serves both as pressure on victims and as a public catalogue of claimed breaches. In the present case the listing of Honey Birdette constitutes 8base’s claim; no additional statements attributed specifically to this victim beyond the assertion of internal-file exfiltration appear in the reported facts.

Honey Birdette and its sector

Honey Birdette is an Australian retailer of luxury lingerie, loungewear, bridal pieces and related products, operating both physical stores and an e-commerce site. Like other specialty fashion and intimate-apparel brands it necessarily maintains customer accounts, order histories, payment-related records, marketing lists and internal business documents.

Retailers in this segment are attractive targets because they hold a mix of personally identifiable information, purchase data and operational files. A breach, even when limited to “internal files,” can therefore touch both the commercial confidentiality of the business and the privacy of people who have shopped with or worked for the brand. The sector’s reliance on online sales and loyalty programmes further concentrates data that threat actors regard as monetisable.

What data was at risk

The public record states only that internal files were exfiltrated in a ransomware attack. No inventory of specific data types—customer names, email addresses, payment card details, employee records or otherwise—has been released. Organisations of Honey Birdette’s type ordinarily hold customer contact and order information, account credentials, staff personal data and assorted corporate documents; whether any of those categories were present among the claimed files remains unconfirmed.

Until a fuller disclosure appears, the exact contents must be regarded as unknown. The sole concrete description supplied by the reporting is the phrase “internal files exfiltrated.”

What's at stake

For individuals the practical risks include unwanted marketing, phishing that references real purchase history, or identity-related misuse if contact or identity documents were among the files. Even partial records can be combined with data from other breaches to build more convincing social-engineering attempts. For the organisation the consequences centre on operational disruption, potential regulatory notification duties, and erosion of customer trust—outcomes that follow many retail ransomware events regardless of whether a ransom is paid.

Because the scale and precise contents remain undisclosed, the full extent of exposure cannot yet be quantified. The prudent assumption is that any internal material taken could contain information of lasting sensitivity to the people it concerns.

Were you affected?

If you have shopped with or worked for Honey Birdette, treat the listing as a prompt to review your exposure rather than as confirmed proof that your data was taken. Practical first steps include:

• Monitor bank and card statements for unfamiliar charges and enable transaction alerts where available.
• Change passwords on any account that reused a Honey Birdette credential, and switch on multi-factor authentication.
• Be alert to phishing messages that mention lingerie purchases, order numbers or account issues.
• Consider a credit or identity-monitoring service if you believe sensitive personal details may have been involved.
• Run a free exposure scan of your email address to check whether it has already appeared in known breach datasets.

Public detail on this incident remains limited; further clarity will depend on official statements from the company or subsequent investigative reporting.

AICompiled with AI assistance from public sources and published under our editorial standards.