Peggy Sage Listed by datacarry Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On August 15, 2025, the French beauty brand Peggy Sage was listed by the ransomware group datacarry as a victim of a ransomware attack involving the exfiltration of internal files. Public detail remains limited: the number of people affected is unknown, and no further confirmation of the incident beyond the group's claim has been provided in available records.

This matters because Peggy Sage operates as a long-established professional cosmetics company serving both individual consumers and salon professionals. Any exposure of internal files raises questions about the potential reach of the incident into business operations and associated personal or commercial information, even while exact impacts stay unconfirmed.

Inside the incident

According to the available record, Peggy Sage was listed by the datacarry ransomware group on August 15, 2025. The listing describes a ransomware attack in which internal files were allegedly exfiltrated. No additional details on the timing of the intrusion, the scale of the compromise, the specific method of access, or any ransom demand have been disclosed. The number of people affected is listed as unknown. Public information stops at the group's claim of the listing and the statement that internal files were taken; nothing further has been independently verified in the provided facts.

The group behind it: datacarry

Datacarry is a ransomware operation that follows the double-extortion model common among such groups. It typically gains access to a target's network, encrypts systems to disrupt operations, and simultaneously copies data before threatening to publish or sell the stolen material if a ransom is not paid. Victims are routinely named on dedicated leak sites as a form of pressure. The group has been observed listing organizations across multiple sectors in this manner. In the present case, the listing of Peggy Sage constitutes a claim by datacarry that the company was successfully attacked and that internal files were exfiltrated; the facts do not confirm independent verification of that claim.

Peggy Sage and its sector

Peggy Sage is a French beauty brand with more than 90 years of history. It specializes in cosmetic and nail-care products, offering nail polish, nail treatments, perfumes, make-up, skincare items, and beauty accessories. The company markets to both individual users and salon professionals worldwide and has established itself as a recognized professional beauty brand. Organizations in the cosmetics and personal-care sector commonly maintain customer and partner databases, supply-chain records, product-formulation details, employee information, and commercial contracts. A breach involving internal files at such a firm can therefore touch both operational continuity and the privacy of people connected to the business, even when the precise contents remain unconfirmed.

What data was at risk

The facts state only that internal files were exfiltrated in a ransomware attack. No specific categories of personal data, financial records, or customer lists have been named. Exact contents are therefore unconfirmed. Companies of this type typically hold employee records, supplier and distributor contacts, sales data, product specifications, and marketing lists. Whether any of those categories were among the files taken has not been disclosed, and the number of individuals potentially affected remains unknown.

What's at stake

For individuals whose information may have been present in the internal files, the practical risks include possible misuse of contact details, identity-related fraud if personal identifiers were stored, or targeted phishing that leverages knowledge of a relationship with Peggy Sage. For the organization itself, the stakes involve operational disruption from any encryption, potential regulatory scrutiny under data-protection rules, and reputational effects among professional clients and consumers. Because the volume and nature of the data remain undisclosed, the concrete extent of these risks cannot yet be measured.

What to do if you're exposed

If you have a past or present connection to Peggy Sage as a customer, salon partner, or employee, treat the listing as a prompt for basic precautions rather than confirmed personal compromise. Public detail on exactly who was affected is limited, so the following steps are prudent first measures:

• Monitor financial and email accounts for unexpected activity or messages that reference the company.
• Change passwords on any accounts that may have been linked to Peggy Sage services, and enable multi-factor authentication where available.
• Be alert to phishing attempts that claim to come from the brand or its partners.
• Consider placing a fraud alert with credit-reporting agencies if you believe sensitive personal data could have been involved.
• Run a free exposure scan of your email address to check whether it has already appeared in known breach data sets.

These actions help reduce residual risk while further information, if any, becomes public. No evidence in the current record establishes that every customer or partner was affected; the steps simply reflect standard practice after a claimed ransomware incident involving internal files.

AICompiled with AI assistance from public sources and published under our editorial standards.