TaylorMade & Sun Day Red golf Listed by ExfilSquad Ransomware Group: What Was Exposed & What To Do

TaylorMade, the golf equipment company, was listed by the ransomware group ExfilSquad in a claim reported on July 26, 2026. Public detail so far centers on an assertion that internal files were exfiltrated in a ransomware attack. The number of people affected remains unknown.

The listing also references Sun Day Red golf alongside TaylorMade. What is confirmed in available reporting is limited: the group claims a compromise involving internal material, and a reported revenue figure of $1.5B appears in the summary attached to the incident record. Exact timing of any intrusion, the method used, and independent confirmation of the claim have not been disclosed in the material at hand.

What happened

According to the incident record, TaylorMade and Sun Day Red golf were listed by the ExfilSquad ransomware group on or about July 26, 2026. The core claim is that internal files were exfiltrated in a ransomware attack. No public technical timeline, initial access vector, or ransom demand details are included in the available facts.

Scale is only partly indicated. The number of individuals affected is listed as unknown. A data summary associated with the record refers to roughly 2 million records. Whether that figure has been verified by TaylorMade or by independent investigators is not stated. Method of attack, duration of access, and whether systems were encrypted in addition to data theft remain undisclosed.

Who is ExfilSquad?

ExfilSquad is presented in the incident record as a ransomware group. Like other actors in this category, such groups typically claim to steal data before or instead of encrypting systems, then list victims on leak sites to pressure payment. Public reporting on ransomware crews generally describes double-extortion tactics: exfiltration followed by threats to publish or sell the material if a ransom is not paid.

For this specific case, the only direct assertion is the leak-site listing itself. The group claims TaylorMade and Sun Day Red golf as victims and that internal files were taken. No further statements attributed to ExfilSquad about this incident—such as sample files, deadlines, or proof packages—are included in the facts provided. The listing should be treated as an unverified claim unless and until the organization or qualified third parties confirm it.

About TaylorMade

TaylorMade is a well-known manufacturer of golf clubs, balls, apparel, and related equipment, serving both recreational and professional players. Sun Day Red is referenced in the same listing; it is publicly associated with golf lifestyle and performance products connected to the broader TaylorMade commercial sphere. Organizations of this type typically maintain customer accounts, order and shipping systems, warranty and support records, wholesale and retail partner data, and internal business documents.

A reported revenue figure of $1.5B is attached to the incident summary. A breach affecting a consumer and wholesale brand in this sector matters because the company holds contact details, purchase histories, and potentially payment-related or account credentials for a large customer base, as well as operational data used to run manufacturing, distribution, and support. Disruption or exposure can affect customers, retailers, and internal operations even when the full scope is still unconfirmed.

What data was at risk

The facts name the exposed material as internal files exfiltrated in a ransomware attack. A data summary linked to the record describes approximately 2 million records said to contain significant personally identifiable information (PII), customer support history, orders, shipping information, business account data, financial and account information, internal notes, attachments, and AI support chat transcripts.

These categories are presented as part of the associated summary rather than as a fully independently audited inventory. The precise contents, whether every listed category was in fact taken, and how complete any dataset is remain unconfirmed in the public facts. Organizations in retail and sporting goods commonly store names, addresses, emails, phone numbers, order and shipment records, support tickets, and business-to-business account details; that typical profile helps explain why such a claim would be taken seriously, but it does not substitute for verification of what was actually copied in this incident.

The real-world impact

If the claimed data were exposed, affected individuals could face phishing or social-engineering attempts that reference real orders, shipping details, or prior support conversations. Reused passwords or account credentials, if present in any financial or account information, could increase risk to other online services. Business account data and internal notes could aid fraud against retailers or partners who deal with TaylorMade.

For the organization, consequences may include regulatory notification duties where personal data is involved, customer-support load, potential fraud losses, and reputational harm while the claim is investigated. Because the number of people affected is officially unknown and independent confirmation is not described in the facts, the practical impact is still being established. No dollar loss figure or confirmed misuse of the data is provided in the available record.

Were you affected?

If you have purchased from TaylorMade or Sun Day Red, created an account, contacted support, or done business with the company as a retailer or partner, monitor account statements and be cautious of unexpected messages that cite order or shipping details. Change passwords on any related accounts, enable multi-factor authentication where available, and treat unsolicited requests for payment or personal information with skepticism. Official notices from the company, if issued, should be read carefully and verified through channels you already trust.

You can also run a free exposure scan of your email address to check whether your information has already surfaced in known breach data sets. That step does not confirm or rule out involvement in this specific incident, but it can help you see whether your credentials or contact details appear in previously disclosed breaches and take follow-up action accordingly.

AICompiled with AI assistance from public sources and published under our editorial standards.