Healthy Living Market and Café listed on Genesis ransomware leak site

• Ransomware group: Genesis
• Country: United States
• Sector: Retail & E-Commerce
• Announcement date: October 21, 2025

The threat group known as Genesis has listed Healthy Living Market and Café on their leak site, claiming to have exfiltrated 400 GB of data. This announcement, posted on October 21, 2025, suggests a significant data breach targeting the organization, though the group's specific motives and ransom demands remain undisclosed.

The claims of the Genesis group

According to the announcement made by the Genesis group, they claim to have compromised the systems belonging to Healthy Living Market and Café. The group has published an official announcement regarding the incident, alleging that they successfully accessed the organization's internal infrastructure. The group claims that the breach occurred around August 31, 2025.

The Genesis group alleges that the stolen information was obtained directly from the company's file servers. While the group has made these claims publicly, it is noted that information regarding this specific group remains limited in the public domain. Ransomware groups often use leak sites to pressure victims by demonstrating that they have successfully bypassed security perimeters and obtained sensitive internal files.

The nature of the allegedly exfiltrated data

The announcement provided by the attackers specifies the types of information that they claim to have stolen from the organization's servers. The data is reported to be substantial in volume, totaling approximately 400 GB. Based on the group's claims, the stolen datasets include a variety of sensitive administrative and internal documents.

The specific categories of data mentioned in the leak include:

• Financial data
• Payroll data
• HR data
• Personal data
• Board materials

The presence of such diverse data types suggests that the attackers may have gained access to multiple departments within the organization, ranging from human resources to executive leadership. The inclusion of managed folders and network user folders in the claim further indicates a broad reach into the organization's digital environment.

Implications and potential risks

The nature of the allegedly exfiltrated data may pose secondary risks such as identity theft and targeted phishing attacks for employees and stakeholders. When sensitive information like payroll and personal data is leaked, individuals within the organization become targets for social engineering attacks. Furthermore, the inclusion of financial and HR records could trigger legal obligations under state-level data privacy regulations for the US-based company.

The publication of this data on a leak site may lead to reputational damage and disruption of operational processes. It can be assessed that the Genesis group tends to utilize such data for double-extortion tactics. Double extortion is a common ransomware strategy where attackers not only encrypt an organization's data to disrupt operations but also steal sensitive information to threaten public disclosure unless a ransom is paid.

In such scenarios, organizations may need to initiate a forensic investigation to determine the actual scope of the breach and notify affected parties. General defensive steps for organizations facing such threats often involve strengthening network segmentation, implementing strict access controls, and maintaining robust backup solutions to mitigate the impact of unauthorized access and data exfiltration.