Makro listed on RansomHouse leak site following claims of data theft

• Ransomware group: RansomHouse
• Country: Netherlands
• Sector: Retail & E-Commerce
• Announcement date: November 20, 2025

RansomHouse claims to have stolen data from Makro

The RansomHouse ransomware group has published a claim on its dedicated leak site asserting that it has successfully targeted Makro. According to the announcement made on November 20, 2025, the threat actors claim to have gained unauthorized access to the organization's internal systems, leading to the theft of sensitive information. This development follows a period of alleged activity that the group claims began on October 17, 2025.

In the announcement, the RansomHouse group is pressuring the management of Makro to establish contact with them. The group has issued threats stating that if their demands are not met, the stolen information will be released publicly on their platform. This tactic is a hallmark of modern ransomware operations, where the threat of exposure is used as leverage to extort organizations.

Details of the alleged data theft

While the group has publicly claimed to have obtained significant amounts of information, they have not provided a detailed inventory or a specific list regarding the scope or the exact types of the leaked data. The announcement remains vague regarding the total volume of files or the specific nature of the documents, leaving the full extent of the breach unconfirmed by the details provided in the leak site post.

Despite the lack of a comprehensive list, the group has explicitly identified the following categories of information as being part of the alleged theft:

• Commercial project documents
• Corporate confidential data

The absence of specific file counts or a defined data size in the public announcement means that the true impact of the data exfiltration remains unknown at this stage.

About Makro

Makro is a Thailand-based wholesale chain. Specializing in food and consumer goods, it provides a wide range of products to professional business operators and individual members.

Analysis and potential impact

The claims made by the RansomHouse group may pose significant risks to the organization's operational continuity and commercial reputation. The inclusion of project documents in the alleged leak suggests a possibility of exposure for trade secrets and strategic plans, which are vital for maintaining a competitive edge in the wholesale and retail sectors.

Given that the organization is based in the Netherlands, potential data breaches may lead to legal sanctions and regulatory scrutiny under the General Data Protection Regulation (GDPR). Furthermore, it is considered that the stolen data could facilitate identity theft or targeted phishing attacks against customers or business partners. Such attacks often exploit the trust established between a large wholesaler and its diverse network of professional clients.

The RansomHouse group has demonstrated a focus on data exfiltration and extortion since 2021. This history indicates that such incidents may result in double-extortion scenarios. In a double-extortion model, attackers not only encrypt an organization's data to disrupt operations but also steal the data beforehand to threaten its public release, thereby increasing the pressure to pay the ransom.

For organizations operating in the retail and e-commerce sectors, these types of threats highlight the importance of robust cybersecurity frameworks. Common defensive steps for organizations facing such threats include implementing strict access controls, maintaining offline backups, and conducting regular security audits to identify vulnerabilities before they can be exploited by threat actors.