MOSS BROS GROUP Listed by conti Ransomware Group: Ransomware Claim — What’s Alleged & What To Do
The MOSS BROS GROUP Listed by conti Ransomware Group (reported September 9, 2021) is an unverified claim; the data involved is undisclosed belonging to roughly unknown people. If you have an account with them, your information may now be circulating on the open web and with data brokers. Here’s exactly what happened, how to check if you were affected, and what to do next.
Details remain limited about an incident in which MOSS BROS GROUP appeared on a ransomware leak site in September 2021. The listing indicates that internal files were taken during a ransomware operation, yet the number of people affected, the precise contents of any data, and confirmation of public release have not been disclosed. For individuals whose records may be involved, the practical concern is whether personal or employment-related information held by a clothing retailer could now circulate among criminal actors who trade in such material.
Breaking down the breach
MOSS BROS GROUP was listed on the Conti ransomware leak site on 9 September 2021. The group claims to have stolen internal data during a ransomware attack. No figure for the number of people affected has been published, and the organisation has not released a statement detailing the scope or method of the intrusion. Public records do not confirm whether the claimed files were subsequently published or sold.
Inside conti
Conti is a ransomware operation that emerged around 2020 and became known for encrypting victim systems while also copying data before encryption. The group typically uses double-extortion tactics, first demanding payment to restore access and then threatening to publish stolen material if the demand is refused. Conti has appeared in multiple public listings involving organisations across retail, logistics and professional services, though each listing represents an unverified claim by the group until independently confirmed.
About MOSS BROS GROUP
MOSS BROS GROUP operates as a menswear retailer with stores and an online presence in the United Kingdom. Companies of this type routinely maintain customer accounts, order histories, payment card details processed through third-party systems, employee records and supplier information. A breach at such a firm can expose routine commercial data that, while not always highly sensitive on its own, may be combined with other sources to build profiles for fraud or targeted scams.
The information in question
The listing refers only to “internal files exfiltrated in ransomware attack.” No inventory of specific data fields has been made public. Retail organisations commonly hold names, addresses, email addresses, purchase records and limited payment information, yet it is not confirmed whether any of these categories were among the files referenced in this case. The exact contents therefore remain unconfirmed.
Why it matters
Even without confirmed publication, the appearance of a company on a ransomware leak site signals that data has left its control. Individuals may face increased risk of phishing or account takeover if email addresses or order details are later traded. For the organisation, the incident adds to the operational costs of incident response, potential regulatory scrutiny and the longer-term task of restoring customer confidence. The absence of published details leaves both customers and the company without a clear picture of exposure.
If your data was in this claimed breach
Monitor bank and retail accounts for unusual activity and consider changing passwords for any services linked to the same email address used with MOSS BROS GROUP. Enable multi-factor authentication where available. Readers can run a free exposure scan of their email address against known breach data sets to check whether their information appears in publicly referenced incidents.
AICompiled with AI assistance from public sources and published under our editorial standards.
How this breach connects
More recent breaches
Chantelle Group Listed by conti Ransomware GroupClementoni Listed by conti Ransomware GroupSpencer Gifts LLC Listed by conti Ransomware GroupSan Carlo Listed by conti Ransomware GroupLatest breaches
Read GalaxyWarden’s full analysis of the MOSS BROS GROUP Listed by conti Ransomware Group →
Publicly posted by conti — unverified claim, pending independent verification
Breach listings — particularly those originating from ransomware or leak sites — are third-party claims that may be unverified, incomplete, or inaccurate. A listing does not by itself confirm that a breach occurred or that any specific data was exposed. Severity is an automated assessment, not a definitive rating. Verification status is shown where available.
Attributions to threat groups and methods reflect public reporting and, in some cases, unverified claims made by the groups themselves; they may be incomplete or later revised. Recent Breaches and GalaxyWarden are independent and are not affiliated with, and do not endorse, any company or group named on this page. This information is aggregated from public sources for awareness only and is not legal, security, or investment advice.