GRANDHOME data allegedly targeted by Lamashtu ransomware group
It is claimed that data belonging to the Thailand-based retailer GRANDHOME has been compromised. The threat actor announced that they intend to leak a dataset consisting of 25,000 files totaling 30 GB.
- Published
- 3 min read
- 3 min read
- Ransomware group: Lamashtu
- Country: Bangladesh
- Sector: Retail & E-Commerce
- Announcement date: May 5, 2026
Lamashtu claims a major data breach at GRANDHOME
The Lamashtu ransomware group has listed data they claim belongs to the Thailand-based retailer GRANDHOME on their leak site. In an announcement posted on May 3, 2026, the group stated they possess an archive of 30 GB containing 25,000 files. This development follows a pattern often seen in modern cyberattacks where threat actors utilize double extortion tactics. In such scenarios, attackers do not merely encrypt an organization's systems but also exfiltrate sensitive information to use as leverage, threatening to publish the stolen data on public leak sites if a ransom is not paid.
The group alleges that the stolen data includes various business and personal records spanning from 2023 to 2026. This multi-year scope suggests that the breach may have involved long-term access to the organization's internal networks. While the specific method of entry remains unknown, the sheer volume of files suggests a significant compromise of the target's digital infrastructure.
Details of the claimed data theft
According to the claims made by the Lamashtu group, the stolen dataset is substantial, totaling 30 GB and consisting of approximately 25,000 files. The group asserts that the information includes a wide variety of sensitive documents that could be highly damaging if released publicly. The alleged content includes accounting records, customer billing documentation, tax forms, insurance policies, Know Your Customer (KYC) verification packages, national ID card copies, gift voucher records, and internal memoranda.
The specific types of data identified in the listing include:
- Customer identity information
- Tax forms
- Insurance policies
- Accounting records
- Internal employee memoranda
The presence of such diverse data types indicates that the breach may have touched multiple departments, from finance and human resources to customer service and sales operations.
About GRANDHOME
Established in 1973, GRANDHOME is a leading Thai retailer specializing in construction materials, home decor, and furnishing products. The company operates as a major hub for high-quality tiles, sanitary ware, and kitchen innovations. As an established player in the retail and e-commerce sector, the organization maintains a significant footprint in the regional market.
Potential impact and security implications
The alleged leak may increase the risk of identity theft and fraud for GRANDHOME customers and employees. The presence of KYC documents and national ID card copies suggests that affected individuals could face long-term security risks, as these documents are frequently used in identity-related crimes. Furthermore, the leaked internal communications and commercial data could create secondary risks regarding the company's supply chain and competitive position.
From a regulatory perspective, it is possible that the organization may face legal sanctions under Thailand's data protection regulations due to the sensitive nature of the information involved. While information about the Lamashtu group remains limited, their ability to claim such a large dataset highlights the ongoing threat posed by ransomware operations to the retail sector.
Organizations operating in the retail and e-commerce sectors can take several defensive steps to mitigate such risks. Implementing robust data encryption for both data at rest and data in transit can help protect sensitive information even if a breach occurs. Furthermore, enforcing strict access controls and multi-factor authentication (MFA) can limit the lateral movement of attackers within a network. Regular security audits and comprehensive employee training on phishing awareness are also essential components of a modern cybersecurity posture. Monitoring for unusual data exfiltration patterns can provide early warning signs of a potential breach before large volumes of data are moved out of the network.