Spijkermat Listed by radiant Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to target organisations of every size, using data theft and public leak-site listings as leverage. In this environment, even specialised consumer-product companies can find themselves named on criminal forums, creating uncertainty for customers and partners. On 29 October 2025, the ransomware group radiant listed Spijkermat, stating that internal files had been exfiltrated. Public detail remains limited, yet the claim alone is enough to warrant careful attention from anyone who has dealt with the company.

What is known is straightforward: Spijkermat appears on radiant’s leak site in connection with a ransomware attack that allegedly involved the theft of internal files. The number of people affected is unknown, and no further technical or financial particulars have been released. The listing itself is an unverified claim by the group; independent confirmation of the full scope has not been made public.

Breaking down the breach

According to the available record, Spijkermat was listed by the radiant ransomware group on 29 October 2025. The group asserts that internal files were exfiltrated during a ransomware attack. No information has been disclosed about the initial access method, the duration of any intrusion, the volume of data taken, or whether encryption of systems also occurred. The number of individuals potentially affected remains unknown. Because these core details are absent from public reporting, the precise timeline and technical character of the incident cannot be established from open sources.

Radiant’s listing is the primary public signal. In the absence of a detailed statement from Spijkermat or independent forensic confirmation, the claim stands as an assertion by the threat actor rather than a fully verified account. Organisations named in this way often face pressure to negotiate or to prepare for possible data publication, yet no evidence of subsequent file dumps or ransom demands specific to this case has been included in the reported facts.

The group behind it: radiant

Radiant operates as a ransomware group that follows the now-common double-extortion model: data is stolen before systems are encrypted, and the threat of public release is used to compel payment. Like other actors in this category, the group maintains a leak site where it names victims and, in some cases, posts samples or full archives of stolen material. Public reporting on radiant has described typical tactics such as phishing or exploitation of remote-access services for initial entry, followed by lateral movement, data staging, and exfiltration. Prior activity attributed to the group has involved a range of sectors, though specifics of those campaigns are not relevant to the present listing.

For the Spijkermat incident, the only claim that can be attributed directly to radiant is the listing itself and the assertion that internal files were taken. No additional statements, screenshots, or file counts from the group concerning this particular victim appear in the available facts. Readers should therefore treat the leak-site entry as an unverified allegation pending further confirmation.

Who is Spijkermat?

Spijkermat specialises in acupressure mats designed to enhance relaxation, alleviate pain, and improve sleep. It operates in the consumer wellness and home-health product sector, selling specialised mats and related items that customers typically purchase online or through retail channels. Companies of this type ordinarily maintain customer databases, order histories, payment-related records, supplier information, and internal operational documents.

A breach affecting such an organisation is consequential because the customer base often includes individuals seeking relief from chronic discomfort or sleep difficulties; these people may have shared personal contact details, shipping addresses, and purchase preferences. Even if the company is not a large healthcare provider, the combination of personal identifiers and product-use context can still create privacy and fraud risks if internal files containing that information leave the organisation’s control.

What was likely exposed

The facts state only that internal files were exfiltrated in a ransomware attack. No inventory of specific data categories—such as customer lists, employee records, financial documents, or intellectual property—has been publicly named. Exact contents therefore remain unconfirmed.

Organisations that manufacture and sell consumer wellness products commonly hold customer names, email addresses, postal addresses, order histories, and payment-processor tokens or invoices. They may also store supplier contracts, inventory data, marketing lists, and internal correspondence. Any of these could theoretically appear among “internal files,” yet without a confirmed disclosure it is impossible to state what was actually taken. Affected individuals should assume that personal information associated with purchases or accounts might be at risk until clearer information emerges.

Why it matters

For people who have bought Spijkermat products or interacted with the company, the principal risks are identity-related fraud, phishing, and unwanted contact. Stolen email addresses and names can be used to craft convincing messages that reference past purchases. Shipping addresses and order details can aid social-engineering attempts. Even if payment-card data is not present, the mere combination of personal identifiers increases the chance of account-takeover attempts on other services where the same credentials or personal details are reused.

For Spijkermat itself, the listing creates operational, reputational, and potential regulatory exposure. Customers may lose trust, partners may demand assurances, and any subsequent publication of files could trigger notification obligations under data-protection rules. The absence of confirmed scale does not remove these concerns; uncertainty itself can prolong disruption and require resources for investigation, customer communication, and system hardening.

If your data was in this claimed breach

If you have an account, order history, or other relationship with Spijkermat, treat the possibility of exposure seriously even while details remain limited. Change any password you used with the company and enable multi-factor authentication wherever available. Monitor bank and card statements for unfamiliar charges, and be sceptical of unsolicited emails or calls that reference your purchases or personal details. Consider placing a fraud alert with credit-reporting services if you live in a jurisdiction that offers that option.

You can also run a free exposure scan of your email address to check whether it has already appeared in known breach data sets. Doing so provides an early indication of whether your information is circulating more widely and helps prioritise further protective steps. Stay alert for official updates from Spijkermat; until more precise information is released, cautious monitoring remains the most practical response.

AICompiled with AI assistance from public sources and published under our editorial standards.