mooregiles.com Listed by safepay Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

When a company that designs and sells luxury leather goods and home furnishings appears on a ransomware group's leak site, the immediate concern is not abstract cybersecurity news. It is whether customer records, employee details, supplier contracts or other personal information have left the organisation's control and could be misused. For anyone who has bought from Moore & Giles, worked with them, or supplied them, the practical stakes are clear: the possibility of identity theft, targeted phishing or further fraud if internal files containing personal data were among those taken.

Public reporting dated 28 March 2025 states that mooregiles.com has been listed by the safepay ransomware group, which claims to have exfiltrated internal files in a ransomware attack. The number of people affected remains unknown, and further technical detail is limited. What follows is a careful account of what is known, what is claimed, and what people connected to the company can usefully do next.

Breaking down the breach

According to the available public record, mooregiles.com was listed by the safepay ransomware group on or around 28 March 2025. The group asserts that it carried out a ransomware attack in which internal files were exfiltrated. No confirmed figure for the volume of data, the exact date of intrusion, the initial access method, or the number of individuals whose information may be involved has been disclosed in the material reviewed for this article. The listing itself is a claim by the threat actor; independent confirmation of the full scope of the incident has not been published alongside the report.

Ransomware incidents of this type typically involve encryption of systems combined with theft of data before encryption, followed by a threat to publish the stolen material if a ransom is not paid. In this case the public facts state only that internal files were exfiltrated and that the victim domain appears on the group's listing. Timing beyond the 28 March 2025 reporting date, the precise scale of the compromise, and any subsequent confirmation or denial by the company remain undisclosed in the source material.

Who is safepay?

Safepay is a ransomware operation that has been observed in public threat intelligence since roughly mid-2024. Like many contemporary ransomware groups, it follows a double-extortion model: encrypting victim systems while also stealing data and threatening to leak it on a dedicated leak site if payment is not made. The group has listed organisations across multiple sectors and geographies, using standard ransomware tactics such as initial access through compromised credentials or vulnerabilities, lateral movement, data staging and exfiltration, and then deployment of encryptors.

Public reporting on safepay has noted that the group maintains a leak site where it posts victim names and, in some cases, samples or larger volumes of stolen data. Listings are claims made by the operators; they do not automatically prove that every file advertised was taken or that every named organisation suffered the full impact asserted. In the present case, the facts record only that mooregiles.com was listed and that the group claims internal files were exfiltrated. No additional statements attributed specifically to safepay about this victim—such as ransom demands, file counts or sample releases—are included in the provided record, so none are repeated here.

About mooregiles.com

Moore & Giles is a Virginia-based company that designs and distributes high-quality leather and luxury home furnishings. Founded in 1933, it works with tanneries around the world and serves high-end residential, hospitality and aviation markets. Its product range also includes handbags, luggage and accessories. The company is known for design innovation and has publicly emphasised environmental accountability in its operations.

Organisations of this kind typically maintain customer order and shipping records, wholesale and trade-account information, employee and contractor data, supplier and tannery contracts, design files, and financial or logistics documentation. Because Moore & Giles operates at the intersection of consumer luxury goods and business-to-business hospitality and aviation supply, a breach of its internal systems can affect both individual purchasers and commercial partners. That combination makes any confirmed data exposure consequential for privacy and for the continuity of trusted commercial relationships.

What was likely exposed

The facts name the exposed material only as “internal files exfiltrated in ransomware attack.” No further breakdown—customer lists, employee records, financial documents, design files or otherwise—has been disclosed. Exact contents therefore remain unconfirmed.

Companies that design and sell leather goods and luxury furnishings commonly hold names, addresses, email addresses and payment or order histories of retail and wholesale customers; personnel files; supplier agreements; shipping and inventory data; and internal correspondence. Any of these categories could, in principle, have been among the internal files taken. Because the public record does not specify which files were removed, it is not possible to state that particular data types were or were not exposed. Readers should treat the precise inventory as unknown until the company or independent investigators provide verified detail.

The real-world impact

For individuals whose information may have been present in the exfiltrated files, the concrete risks include phishing or social-engineering attempts that reference real orders or account details, attempts to reuse credentials on other sites, and, if payment or identity documents were stored, a heightened chance of fraud. Even limited internal files can contain enough context for convincing scams. For commercial partners and suppliers, exposure of contracts or pricing information can create competitive or contractual complications.

For the organisation itself, a ransomware incident that includes data theft typically brings operational disruption, potential regulatory notification duties, reputational questions from customers and trade partners, and the cost of investigation and remediation. Because the number of people affected is reported as unknown and the exact data types remain unconfirmed, the full scale of these impacts cannot yet be quantified from public sources. The absence of confirmed numbers does not mean the risk is zero; it means affected parties must proceed on the basis of prudent caution rather than precise knowledge.

If your data was in this claimed breach

If you have purchased from Moore & Giles, worked for the company, or supplied it, treat the possibility of exposure seriously even while details remain limited. Change passwords on any accounts that reuse credentials you may have shared with the company, enable multi-factor authentication wherever available, and watch for unexpected emails or calls that reference orders, invoices or personal details. Monitor financial statements and credit reports for unusual activity. Consider placing a fraud alert with major credit bureaus if you believe sensitive identity information could have been involved.

You can also run a free exposure scan of your email address to check whether that address has already appeared in known breach data sets. Such a scan will not prove or disprove involvement in this specific incident, but it can surface other exposures that warrant the same protective steps. Remain alert for official statements from Moore & Giles; until more verified information is released, the safest course is measured caution rather than assumption that your data was or was not taken.

AICompiled with AI assistance from public sources and published under our editorial standards.