Peruvian Connection Listed by worldleaks Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On September 23, 2025, the high-end fashion retailer Peruvian Connection was listed by the worldleaks ransomware group. Public reporting indicates that internal files were exfiltrated during a ransomware attack, though the number of people affected remains unknown and further details about the incident have not been disclosed. For customers, employees, and partners of a company that sells clothing and accessories worldwide, any unauthorized access to internal systems raises questions about what information may have been taken and how it could be misused.

The listing itself is a claim by the group rather than an independently confirmed disclosure by the company. As with many such incidents, the available public record is limited, leaving those who may have been affected to weigh the known facts carefully while waiting for additional verified information.

Inside the incident

What is known so far is narrow. Peruvian Connection was reported as listed by worldleaks on September 23, 2025. The available summary states that internal files were exfiltrated in a ransomware attack. No figure has been given for the number of people affected, and public detail does not specify the exact timing of the intrusion, the method of initial access, the volume of data taken, or whether any ransom demand was made or paid. There is also no public confirmation from the company itself in the provided record that would independently verify the group's claims or describe containment and recovery steps.

In ransomware cases of this type, attackers typically encrypt systems and remove copies of data before demanding payment, but those operational specifics remain undisclosed here. The incident is therefore best understood as a claimed listing accompanied by a statement that internal files left the network, with scale, duration, and technical pathway still unconfirmed.

Inside worldleaks

Worldleaks is a ransomware operation that has appeared in public threat reporting as a group that conducts double-extortion attacks. In such campaigns the actors encrypt victim systems and simultaneously exfiltrate data, then threaten to publish the stolen material on a dedicated leak site if payment is not received. Listings on these sites are used both as pressure and as a form of advertising to other potential victims. The group, like others in this category, typically claims responsibility by posting the victim's name, sometimes with sample files or descriptions of the data taken, though the accuracy of those claims varies and is not automatically verified by independent parties.

Public knowledge of worldleaks centers on this pattern of activity rather than on any single incident. The group is known for targeting organizations across sectors and for using leak-site postings as a core element of its pressure campaign. In the present case the listing of Peruvian Connection should be treated as an assertion by the group: it claims the retailer was hit and that internal files were removed. No additional statements attributed to worldleaks about this specific victim appear in the available facts, and no independent forensic confirmation is provided.

Who is Peruvian Connection?

Peruvian Connection is a high-end fashion retailer that specializes in luxurious alpaca wool and pima cotton clothing and accessories for women. Founded in 1976, the company blends modern, bohemian styles with traditional Andean knitting techniques. Its product range includes sweaters, dresses, skirts, and jewelry. It sells both online and through physical stores in multiple countries.

Retailers of this kind typically maintain customer account records, order histories, payment-related information, employee data, supplier contracts, and internal operational documents. Because the business operates internationally and handles both e-commerce and brick-and-mortar sales, a compromise of internal systems can affect a geographically dispersed set of individuals and partners. The consequential nature of a breach here stems from that combination of personal and commercial data that fashion retailers ordinarily process, even when the precise contents of any given incident remain unconfirmed.

What data was at risk

The facts name the exposed material only as internal files exfiltrated in a ransomware attack. No further breakdown—such as customer records, payment card data, employee files, or specific document categories—is provided. Public detail is therefore limited to that general description.

Organizations in the apparel retail sector commonly hold names, addresses, email addresses, purchase histories, loyalty or account credentials, and sometimes partial payment information, along with human-resources and vendor records. Whether any of those categories were among the internal files claimed by worldleaks is unconfirmed. Readers should treat the exact contents as unknown until additional verified information becomes available.

What's at stake

For individuals, the primary concern is the possible exposure of personal information that could be used for phishing, account takeover, or identity-related fraud. Even when the precise data types are not listed, the mere fact of internal-file exfiltration creates a risk that contact details or other identifiers could later appear in secondary criminal markets. Employees and contractors face similar risks if personnel or payroll-related files were included.

For the organization the stakes include operational disruption from the ransomware encryption itself, potential regulatory notification duties, reputational damage among customers who value privacy, and the cost of investigation and remediation. Because the number of people affected is unknown and the data inventory is undisclosed, the full scope of these consequences cannot yet be measured. The practical effect is a period of uncertainty in which both the company and those connected to it must monitor for secondary misuse while the facts remain incomplete.

Were you affected?

If you have shopped with Peruvian Connection, worked for the company, or supplied goods or services to it, treat the possibility of exposure seriously even though the scale remains unknown. Begin by changing passwords on any accounts that reuse credentials associated with the retailer, enable multi-factor authentication wherever available, and watch bank and credit statements for unexpected activity. Be alert to phishing messages that reference recent purchases or account issues, as attackers often exploit breach publicity.

You can also run a free exposure scan of your email address to check whether your information has already surfaced in known breach data sets. That step provides a concrete, low-effort way to assess personal risk while official details continue to develop. Continue to monitor reliable sources for any further statements from the company or independent investigators.

AICompiled with AI assistance from public sources and published under our editorial standards.