Mammut Sports Group Listed by datacarry Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to target mid-sized manufacturers and retailers across Europe, using data theft as leverage even when encryption is secondary. In this environment, the appearance of a well-known outdoor-equipment brand on a leak site is a routine but still consequential event for customers, partners and staff whose details may sit inside corporate systems.

On 27 September 2024, Mammut Sports Group was listed by the ransomware group datacarry. Public reporting states that internal files were exfiltrated in a ransomware attack; the number of people affected remains unknown and further technical detail has not been released. The listing itself is a claim by the group, not an independently verified confirmation of every asserted fact.

Breaking down the breach

According to available records, Mammut Sports Group was named on datacarry’s leak site on 27 September 2024. The sole concrete description of the incident is that internal files were allegedly exfiltrated during a ransomware attack. No public figure has been given for the volume of data taken, the number of systems affected, the precise date of initial access, or the method of entry. Whether encryption was also deployed, whether a ransom demand was issued, and whether any data has been published remain undisclosed. The absence of these particulars is typical of early-stage listings; organisations and investigators often withhold operational detail while containment and forensic work continue.

The group behind it: datacarry

Datacarry is a ransomware operation that follows the now-standard double-extortion model: data is stolen before or instead of encryption, and victims are threatened with public release if payment is not made. The group maintains a leak site on which it posts victim names, sample files and countdown timers. Like other actors of this type, it tends to target organisations that hold commercially or personally sensitive material and that may face regulatory or reputational pressure to resolve the incident quietly. Prior public listings by datacarry have involved a range of industrial, retail and professional-services firms; the group’s claims are routinely treated as unverified until the victim or independent researchers corroborate them. In the present case, the only assertion that can be attributed to datacarry is the listing of Mammut Sports Group itself and the statement that internal files were taken.

About Mammut Sports Group

Mammut Sports Group is a Swiss multinational that designs, manufactures and retails mountaineering, trekking and outdoor equipment. Its catalogue covers clothing, backpacks, footwear, climbing hardware and sleeping systems; the company markets itself on technical performance, sustainability and fair labour practices. As a consumer-facing brand with both wholesale and direct-to-consumer channels, it necessarily maintains customer databases, order histories, loyalty or warranty records, supplier contracts, employee files and internal product-development material. A breach at such an organisation therefore carries consequences beyond the immediate technical incident: it can affect individuals who bought gear, staff who work for the company, and business partners who share commercial data.

What data was at risk

The only data category named in public reporting is “internal files” exfiltrated in the ransomware attack. No further inventory—customer names, email addresses, payment-card data, employee records, source code or design documents—has been disclosed. Organisations of Mammut’s type typically store customer contact and purchase information, warranty registrations, employee personal data, supplier agreements and proprietary product specifications. Whether any of those categories were among the files taken remains unconfirmed. Until Mammut or independent investigators publish a verified list, the precise contents of the exfiltrated material must be treated as unknown.

The real-world impact

For individuals whose information may have been inside the stolen files, the practical risks are familiar: phishing or social-engineering attempts that reference genuine order or account details, possible credential stuffing if passwords were reused, and longer-term exposure of contact data on criminal marketplaces. Because the number of affected people is unknown, it is impossible to quantify how many customers or employees face these risks. For the company, the consequences include the cost of forensic investigation, potential regulatory notification duties under Swiss and European data-protection rules, disruption to operations while systems are secured, and reputational pressure from customers who expect outdoor brands to protect personal information as carefully as they design safety-critical gear. None of these outcomes has yet been publicly quantified.

What to do if you're exposed

Anyone who has purchased from Mammut, registered a product warranty, or worked for the company should treat the possibility of exposure seriously even while exact details remain limited. Change passwords used on Mammut-related accounts and any other sites where the same credentials were reused; enable multi-factor authentication wherever it is offered; and remain alert for unsolicited messages that cite recent orders or personal details. Monitor financial statements for unexpected activity. Readers can also run a free exposure scan of their email address to check whether that address has already appeared in known breach data sets; such a check provides an early warning if the same address later surfaces in connection with this or other incidents. If Mammut issues official guidance or a notification, follow the steps it recommends.

AICompiled with AI assistance from public sources and published under our editorial standards.