Westwing Home & Living Listed by coinbasecartel Ransomware Group: Ransomware Claim — What’s Alleged & What To Do
Westwing Home & Living was listed on February 24, 2026 by the coinbasecartel ransomware group, which claims to have stolen internal files from the company. Individuals are advised to check whether their information was involved and to follow any guidance issued by Westwing or relevant authorities.
People who shopped at Westwing Home & Living or held membership accounts may now face the possibility that internal company files have left the organisation. On 24 February 2026 the ransomware group coinbasecartel listed the company on its leak site, stating that files had been taken during a ransomware incident. The number of individuals affected and the precise contents of those files remain unknown.
What happened
The only confirmed public information is the listing itself. The group claims to have exfiltrated internal files in a ransomware attack against Westwing Home & Living. No statement from the company, no official incident report, and no independent verification of the volume or nature of the data have been published. The date the files were taken, the method of entry, and any ransom demand or payment status are not disclosed in available records.
Who is coinbasecartel?
Coinbasecartel is a ransomware operator that maintains a public leak site to pressure victims. Like other groups in this category, it typically combines file encryption on targeted networks with the threat of publishing stolen material. Its listings appear without prior independent confirmation, and the accuracy of each claim must be assessed separately. No further details about prior activity by this specific group are contained in the present incident record.
Westwing Home & Living and its sector
Westwing Home & Living is a European e-commerce company headquartered in Munich that sells furnishings and home décor through a membership model. It operates in eleven countries and maintains customer accounts, order histories, and supplier relationships. Retail and e-commerce platforms routinely process names, delivery addresses, contact details, and payment information, making them attractive targets for data theft even when the exact records taken are not yet known.
The information in question
The listing refers only to “internal files exfiltrated in ransomware attack.” No inventory of file types, customer records, or employee data has been released. While organisations of this kind commonly store account credentials, order and payment details, and internal communications, the actual contents of the exfiltrated material remain unconfirmed.
What's at stake
Exposed internal files can contain customer identifiers, order patterns, or authentication data that could be used for targeted fraud or account takeover. For the company, the incident adds operational disruption, potential regulatory scrutiny under European data-protection rules, and reputational damage. Because the scale of exposure is still unknown, the full extent of these consequences cannot yet be measured.
What to do if you're exposed
Monitor bank and email accounts for unusual activity and consider changing passwords, especially if the same credentials are used elsewhere. Enable multi-factor authentication on any Westwing-related accounts and on linked services. Readers can run a free exposure scan of their email address against known breach data to check whether their information appears in public listings from this or other incidents.
AICompiled with AI assistance from public sources and published under our editorial standards.
How this breach connects
More recent breaches
Tab Service Listed by coinbasecartel Ransomware GroupPlaymates Toys Listed by coinbasecartel Ransomware GroupThe Epoch Times Listed by coinbasecartel Ransomware GroupCarters Listed by coinbasecartel Ransomware GroupLatest breaches
Publicly posted by coinbasecartel — unverified claim, pending independent verification
Breach listings — particularly those originating from ransomware or leak sites — are third-party claims that may be unverified, incomplete, or inaccurate. A listing does not by itself confirm that a breach occurred or that any specific data was exposed. Severity is an automated assessment, not a definitive rating. Verification status is shown where available.
Attributions to threat groups and methods reflect public reporting and, in some cases, unverified claims made by the groups themselves; they may be incomplete or later revised. Recent Breaches and GalaxyWarden are independent and are not affiliated with, and do not endorse, any company or group named on this page. This information is aggregated from public sources for awareness only and is not legal, security, or investment advice.