Camomilla listed on datacarry leak site

• Ransomware group: datacarry
• Country: Italy
• Sector: Retail & E-Commerce
• Announcement date: December 6, 2025

The retail and e-commerce company Camomilla has been listed on a leak site by the threat actor group known as datacarry. The group has published an announcement claiming that they have successfully obtained data belonging to the organization.

The claim by datacarry

On December 6, 2025, the datacarry group released an announcement on their dedicated leak site, officially listing Camomilla as a victim. Through this publication, the group claims to have gained access to the organization's data. At this stage, information regarding the specific identity and operational methods of the datacarry group remains limited within the public domain, making it difficult to establish a broader pattern of their activities.

Ransomware groups often utilize leak sites as a tool for double extortion. In such scenarios, attackers do not only encrypt an organization's systems to disrupt operations but also threaten to publish sensitive information on public platforms if a ransom is not paid. This tactic is designed to maximize pressure on the victim by threatening reputational damage and legal consequences. While the presence of a listing on a leak site is a significant indicator of a potential security incident, the accuracy of the threat actor's claims and the actual scope of the leaked data remain unverified.

Data involved in the alleged breach

Despite the announcement made by the datacarry group, the listing provides no specific details regarding the content of the allegedly leaked data. No screenshots or specific file types have been provided by the attackers to substantiate their claims. Furthermore, no information has been released concerning the total size of the data or the specific number of files involved in the incident.

• No data types were specified in the listing.

Because no details have been provided, the exact nature of the information held by the attackers remains unknown. In many cyberattacks, the lack of immediate transparency from threat actors can create a period of uncertainty for the targeted organization as they work to determine the extent of the exposure.

About Camomilla

Camomilla Milano is an Italian-based retail brand that specializes in the design and sale of various fashion and lifestyle items. The company is recognized for its unique designs and a wide range of products, which include women's accessories, handbags, fashion items, and home goods.

Potential risks and organizational implications

The claim that the organization's data has been leaked poses significant risks, particularly regarding the potential for identity theft or fraud targeting customers and employees. Because Camomilla is based in Italy, any confirmed data breach could trigger legal obligations and potential sanctions under the General Data Protection Regulation (GDPR). Such regulations require organizations to implement strict protections for personal data and mandate specific notification procedures in the event of a breach.

Given that the organization operates within the e-commerce sector, the risks are compounded. If payment information or sensitive customer data were to be exposed, the risk of secondary attacks—such as phishing campaigns or fraudulent transactions—would increase significantly. For organizations in the retail and e-commerce sectors, maintaining robust security postures is essential to mitigate these risks.

To defend against such threats, organizations typically focus on several defensive layers. This includes implementing strong access controls, such as multi-factor authentication, and maintaining rigorous patch management to close vulnerabilities. Additionally, monitoring for unauthorized data exfiltration and conducting regular security audits can help identify potential breaches before they escalate. As the situation regarding Camomilla remains uncertain due to the unverified nature of the threat actor's claims, the actual severity of the incident cannot yet be determined.