Swipe.bg Listed by ransomed Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On 4 September 2023, the Bulgarian online marketplace Swipe.bg appeared on the leak site of the ransomware group known as ransomed. The group claimed it had obtained the site’s data and demanded a ransom. Public reporting does not confirm how many people were affected, nor does it independently verify the full scope of what was taken. What is known so far rests largely on the group’s own listing and a brief description of internal files said to have been exfiltrated in a ransomware attack.

For customers and others who have used Swipe.bg, the listing raises practical questions about personal information that may now be in criminal hands. Exact counts and a full inventory of files remain undisclosed outside the attackers’ claims.

Inside the incident

According to the available record, Swipe.bg was listed by ransomed on 4 September 2023. The group stated that it had “successfully obtained all data” from the marketplace and described the material as internal files taken in a ransomware attack. In its own wording it named categories including userdata, customer chats, SSNs, numbers, addresses “and more,” and it set a ransom demand of $50,000.

No independent confirmation of the intrusion method, the precise date of initial access, the volume of data, or the number of affected individuals has been made public in the facts at hand. Whether any ransom was paid, whether data was later published, and whether the company issued its own notice are likewise undisclosed. The incident is therefore documented primarily as a claim on a ransomware leak site rather than as a fully detailed, externally verified breach report.

The group behind it: ransomed

Ransomed is a ransomware operation that has appeared in public reporting as a group that breaks into organisations, steals data, and threatens to publish or sell it unless a payment is made. Like other actors in this category, it typically advertises victims on a dedicated leak site, posts samples or descriptions of stolen material, and sets a ransom figure. Its model relies on double pressure: encryption or disruption inside the victim environment, combined with the threat of exposing sensitive files.

Well-established public accounts of such groups emphasise that leak-site posts are claims controlled by the attackers. They may exaggerate what they hold or the completeness of a theft in order to increase leverage. In this case, ransomed’s listing of Swipe.bg and its description of the data and the $50,000 demand should be read as the group’s assertion, not as independently audited fact. No further statements attributed specifically to ransomed about this victim beyond that listing appear in the given record.

About Swipe.bg

Swipe.bg is described in the attackers’ own text as an online marketplace known for low prices. Marketplaces of this kind typically connect buyers and sellers, process orders, and store account and transaction-related information. Operators in this sector commonly hold customer registration details, contact data, message or chat logs between users and support, delivery or billing addresses, and sometimes identity or payment-related fields depending on local practice and regulation.

A breach affecting such a platform is consequential because the data is often concentrated, relatively current, and tied to real commercial activity. Even when the exact file list is unconfirmed, the combination of identity, contact, and communication records can be reused for fraud, phishing, or further targeting. For a site serving a consumer audience, the potential reach extends beyond a single corporate network to ordinary people who simply bought or sold goods online.

What was likely exposed

The facts state that internal files were exfiltrated in a ransomware attack. The group’s claim lists userdata, customer chats, SSNs, numbers, addresses and more. Public detail does not independently confirm each category or the completeness of the haul. Organisations of this type typically hold account profiles, order and shipping information, support correspondence, and whatever identity or contact fields they collect at registration or checkout; whether every such field was present and taken in this incident remains unconfirmed outside the attackers’ statements.

Concrete points drawn only from the reported claim include:

• Userdata (as asserted by the group)
• Customer chats
• SSNs
• Numbers and addresses
• A stated ransom demand of $50,000
• Number of people affected: unknown

Readers should treat the named categories as alleged until corroborated by the organisation or by independent analysis of leaked material.

What's at stake

If the claimed data types are accurate, affected individuals face familiar but serious risks: targeted phishing that references real orders or chats, account takeover attempts on the marketplace or on other services where the same email and password were reused, and possible identity-related misuse where government identifiers or full addresses were stored. Customer chats can reveal personal circumstances, disputes, or contact details that make social-engineering messages more convincing.

For Swipe.bg, the stakes include operational disruption from the ransomware event itself, loss of customer trust, possible regulatory scrutiny under data-protection rules that apply to Bulgarian and EU operators, and the longer-term cost of investigation, notification, and hardening. Because the number of people affected is unknown, the scale of any notification or remediation effort cannot yet be judged from public facts alone. None of this establishes negligence as a proven finding; it simply describes the ordinary consequences when a consumer marketplace’s internal files are claimed to have left its control.

If your data was in this claimed breach

If you have used Swipe.bg, treat the listing as a reason to act cautiously rather than as proof that your specific record was taken. Change your password on the site and on any other account where you used the same or a similar password. Enable multi-factor authentication wherever it is offered. Watch for unexpected messages that mention orders, chats, or personal details from the platform; verify any such contact through official channels rather than links in the message. Monitor bank and card statements if you stored payment methods, and consider credit or identity monitoring if you believe government identifiers or full addresses were on file.

You can also run a free exposure scan of your email address to check whether it has already appeared in known breach data sets. That check does not prove or disprove inclusion in this specific incident, but it can show whether your address is circulating more widely and help you prioritise further password and account hygiene.

AICompiled with AI assistance from public sources and published under our editorial standards.