Decorolala data allegedly leaked by BYOD ransomware group

• Ransomware group: BYOD
• Country: Canada
• Sector: Retail & E-Commerce
• Announcement date: October 13, 2026

BYOD group claims Decorolala data breach

The threat actor known as BYOD has listed data allegedly belonging to Decorolala on its leak site. This announcement, which appeared on October 13, 2026, marks a potential significant data leak for the retail company. The group has stated that the data may be removed if communication is established with their team, a tactic often associated with modern cyber extortion methods.

Information regarding the BYOD group remains limited, as there is little publicly available data concerning their specific operations or identity. The group's announcement is categorized as a data leak notification, signaling that they claim to have successfully compromised the target's systems and exfiltrated sensitive information.

Details of the alleged data theft

According to the claims made by the threat actor, the stolen dataset is substantial in scope. The announcement claims to contain data belonging to 60,544 customers. The specific types of information allegedly compromised include a wide range of personal and transactional details. While the group has not provided any screenshots to verify the contents of the leak, the list of affected data types is quite extensive.

The information allegedly included in the leak consists of the following:

• Customer contact information
• Address data
• Order history
• Geographic location data

More specifically, the group claims the data includes full names, email addresses, and phone numbers. Furthermore, the leak is said to contain home addresses, ZIP codes, and geographic coordinates. Transactional and technical details are also reportedly involved, such as order details, UPS tracking numbers, and the specific device information used during the checkout process.

About Decorolala

Decorolala is a Canada-based e-commerce platform. The organization specializes in the sale of home essentials and decor products, serving customers through its online retail operations.

Risk assessment and industry implications

The claims made by BYOD pose several secondary risks to the customers of Decorolala. The exposure of such a diverse range of personal information, including names, addresses, and contact details, can facilitate identity theft and highly targeted phishing attacks. Furthermore, the inclusion of home addresses and specific order details may lead to physical security risks for the individuals involved.

From a regulatory perspective, because the entity is based in Canada, a confirmed breach could lead to legal proceedings and regulatory penalties under the Personal Information Protection and Electronic Documents Act (PIPEDA). The threat actor's offer to remove the data upon establishing communication may be considered part of a double extortion tactic. In double extortion, attackers not only encrypt an organization's data but also steal it, threatening to leak it publicly unless a ransom is paid, thereby increasing the pressure on the victim.

For organizations operating in the retail and e-commerce sector, such incidents highlight the critical importance of robust data protection strategies. Common defensive steps for organizations include implementing multi-factor authentication (MFA) across all systems, maintaining strict access controls to limit the scope of potential breaches, and conducting regular security audits. Additionally, encrypting sensitive customer data at rest and in transit can mitigate the impact if a breach occurs. As ransomware leak sites continue to be used as tools for extortion, companies must develop comprehensive incident response plans that account for both data recovery and the complexities of public data exposure.