NOWFOODS.COM Listed by clop Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

When a company that sells everyday health products appears on a ransomware group’s leak site, the practical concern is straightforward: internal files may have left the organisation’s control, and people who buy from, work with, or supply that company cannot yet know whether their own information is among them. Public detail on this incident remains limited, so the immediate stakes are uncertainty rather than confirmed identity theft or account takeover.

On 22 December 2022, NOWFOODS.COM was listed by the clop ransomware group. The listing asserts that internal files were exfiltrated in a ransomware attack. The number of people affected is unknown, and the precise contents of those files have not been publicly itemised beyond the general description of internal material. For customers, employees, and partners of a vitamins-and-supplements business, that gap in confirmed detail is itself the problem that needs careful handling.

What happened

According to the publicly reported record, NOWFOODS.COM was named on a clop leak site on 22 December 2022. The group’s claim is that internal files were taken during a ransomware attack. No confirmed figure for the number of individuals affected has been released. No technical description of the initial access method, the duration of any intrusion, or the exact volume of data has been included in the available summary. The organisation is identified in reporting as NOW Foods, a maker of vitamins, supplements, and essential oils. Beyond the leak-site listing and the characterisation of the material as internal files exfiltrated in a ransomware attack, further operational specifics remain undisclosed.

The group behind it: clop

Clop is a well-documented ransomware operation that has, for years, combined encryption of victim systems with the theft of data and the threat of public release. The group typically posts victim names on a dedicated leak site as part of a double-extortion model: pay and the data stays private, or refuse and selected files may be published. Clop has previously been associated with large-scale campaigns that exploited vulnerabilities in widely used file-transfer and collaboration products, though no such technical detail is supplied for this particular listing. Its public communications are claims, not independently verified inventories. In this case the only assertion on record is that NOWFOODS.COM appears on the group’s site in connection with exfiltrated internal files; nothing further about demands, deadlines, or sample data has been furnished in the facts at hand.

About NOWFOODS.COM

NOW Foods is a long-established manufacturer and seller of dietary supplements, vitamins, minerals, and essential oils. Companies in this sector routinely maintain customer order and account records, employee and contractor information, supplier and wholesale partner details, product formulations, quality-control documentation, and internal business correspondence. Because the products are sold directly to consumers and through retail channels, the organisation holds data that can link names, contact details, purchase histories, and sometimes payment-related information. A ransomware incident that involves the removal of internal files therefore raises questions not only for the company’s operations but for anyone whose personal or commercial information may have been stored in those systems. The consequential nature of the event stems from that ordinary concentration of records rather than from any exotic category of data.

The information in question

The available record states only that internal files were exfiltrated. No inventory of specific data types—such as customer lists, employee records, financial documents, or health-related purchase data—has been publicly confirmed. Organisations of this kind typically retain order histories, shipping addresses, email addresses, loyalty or account identifiers, human-resources files, and vendor contracts. Whether any of those categories were among the files claimed by clop is unconfirmed. Readers should treat the exposure as a possibility that requires vigilance rather than as a verified catalogue of stolen fields.

What's at stake

For individuals, the concrete risks are the usual ones that follow any unauthorised removal of business files: potential phishing or social-engineering attempts that reference real order or account details, recycling of passwords if the same credentials were used elsewhere, and longer-term exposure if contact or identity information surfaces later on criminal markets. Because the scale and exact contents remain unknown, no one can yet rank the severity for any single person. For the organisation, the stakes include operational disruption, regulatory notification duties if personal data is later shown to be involved, reputational damage, and the cost of investigation and remediation. None of these outcomes is guaranteed by a leak-site listing alone; they are the foreseeable consequences if the claimed exfiltration proves accurate and material.

What to do if you're exposed

If you have an account, order history, or employment or supplier relationship with NOW Foods, treat the incident as a prompt to review your own exposure rather than as proof that your data is already public. Change passwords on any related accounts and on any other services where you reused the same credentials. Enable multi-factor authentication wherever it is offered. Watch for unexpected messages that claim to relate to orders, refunds, or account problems, and avoid clicking links or opening attachments from unfamiliar senders. Monitor financial statements for unfamiliar charges. You can also run a free exposure scan of your email address to check whether it has already appeared in known breach data sets; that step gives a practical baseline without requiring you to assume the worst about this specific event. If you later receive formal notification from the company, follow the instructions it provides, including any offer of credit monitoring. Public detail on this incident is still limited, so measured personal hygiene around credentials and communications remains the most useful immediate response.

AICompiled with AI assistance from public sources and published under our editorial standards.