Peggy Sage listed on datacarry leak site

• Ransomware group: datacarry
• Country: France
• Sector: Retail & E-Commerce
• Announcement date: August 15, 2025

The French-based cosmetics brand Peggy Sage has been listed on a leak site by the threat actor known as datacarry. According to the announcement made on August 15, 2025, the group claims to have successfully breached the organization's networks and exfiltrated data.

The claimed attack and group activity

The datacarry group announced on August 15, 2025, that it has listed data belonging to Peggy Sage on its leak site. The threat actor claims to have gained access to the organization's networks and exfiltrated data. While the group has made this public claim, information regarding the specific identity and background of this group remains limited in the public domain.

Ransomware groups often utilize leak sites to exert pressure on their victims. These sites serve as a platform where threat actors post information about targeted organizations to shame them into paying ransoms. This tactic is a central component of modern cyber extortion. When a group claims to have access to a network, it signals a potential compromise of the target's digital perimeter and internal assets.

Details regarding the alleged data leak

At this time, the listing provides no specific details regarding the nature of the allegedly leaked data. No information or screenshots regarding the content of the data have been provided by the threat actor. Furthermore, there is no information available regarding the total size of the data or the specific number of files involved in the alleged breach.

The listing names no specific data types that have been compromised.

Potential risks and secondary impacts

The alleged leak may pose secondary risks such as identity theft or targeted phishing attacks for the organization's customers and employees. When sensitive information is exfiltrated, it can be used by malicious actors to craft highly convincing social engineering campaigns. These campaigns often target individuals within the organization or the customer base to gain further access or to commit financial fraud.

About Peggy Sage

Peggy Sage is a French-based brand that develops and markets cosmetic products, makeup, and nail care items for professional beauty experts. Founded in 1925, the company operates with an extensive global distribution network.

Analysis and organizational implications

Given that the organization is based in France, a potential data breach could lead to legal proceedings and administrative sanctions under the General Data Protection Regulation (GDPR). Compliance with such frameworks is a critical concern for organizations operating within the European Union, as they must adhere to strict standards regarding the protection and processing of personal data.

Until the content of the data is clarified, the impact on the organization's operational continuity remains uncertain. If the threat actor employs a double-extortion strategy, pressure on the organization to pay a ransom may increase. Double extortion is a technique where attackers not only encrypt an organization's data to disrupt operations but also steal sensitive information to threaten its public release, thereby increasing the leverage used during negotiations.

For organizations in the retail and e-commerce sectors, maintaining robust security postures is essential to mitigate these risks. Common defensive steps include implementing multi-factor authentication, maintaining regular offline backups, and conducting regular network monitoring to detect unauthorized access. As the situation regarding Peggy Sage evolves, the clarity of the leaked data will be the determining factor in assessing the full scope of the incident's impact.