Sika Footwear listed on Worldleaks leak site

• Ransomware group: Worldleaks
• Country: Denmark
• Sector: Retail & E-Commerce
• Announcement date: August 26, 2025

Worldleaks claims data exfiltration against Sika Footwear

The threat actor known as Worldleaks has listed the Denmark-based company Sika Footwear on its dedicated leak site. According to the announcement made on August 26, 2025, the group claims to have successfully exfiltrated data from the organization's systems. This development follows a claimed attack date of July 18, 2025.

Worldleaks is described as a group that emerged following the cessation of encryption activities by Hunters International. Unlike traditional ransomware operations that focus on locking files to disrupt business operations, Worldleaks focuses exclusively on data exfiltration and extortion. This shift in tactics reflects a growing trend in the cybercrime landscape where threat actors prioritize the theft of sensitive information to use as leverage during negotiations, a method often referred to as pure extortion or data-focused extortion.

Details regarding the alleged data breach

At this stage of the incident, the threat actor has not provided specific details regarding the contents of the allegedly stolen information. There is currently no information or sample files provided regarding the nature of the allegedly exfiltrated data. Furthermore, the group has not disclosed the total volume of data stolen or the specific number of files involved in the breach.

Summary of available information

• No specific data types have been identified in the listing.
• No sample files have been released.
• No ransom demand has been stated.

About Sika Footwear

Sika Footwear is a Danish company that designs and manufactures work shoes and safety footwear for professional use. It specializes in providing specialized footwear solutions, particularly for the healthcare, food, and industrial sectors. The company operates within the retail and e-commerce sector, providing essential safety equipment to various professional industries.

Potential implications and organizational risks

The claim regarding the exfiltration of Sika Footwear's data may pose secondary risks such as identity theft or targeted phishing attacks against the company's customers and employees. When sensitive information is exfiltrated, attackers often use it to craft highly convincing social engineering campaigns, making them more likely to succeed against unsuspecting individuals within the organization or its client base.

As a Denmark-based entity, any potential data breach could trigger legal consequences and administrative processes under the European Union's General Data Protection Regulation (GDPR). Organizations operating within the EU must adhere to strict protocols regarding the protection of personal data and the timely reporting of breaches to the relevant supervisory authorities to mitigate legal and regulatory exposure.

The strategy employed by the Worldleaks group, which focuses on direct data exfiltration and extortion rather than encryption, may directly impact the organization's commercial reputation and operational security. Because the group does not rely on disrupting system availability through encryption, the primary leverage is the threat of public exposure of sensitive information.

Given the company's position in the sector, it is possible that the leaked data could also have negative implications for supply chain security. In modern industrial environments, a breach at a specialized provider can create ripple effects throughout the supply chain, potentially exposing vulnerabilities or sensitive business relationships that could be exploited by other threat actors. To defend against such threats, organizations in the retail and industrial sectors typically focus on robust data loss prevention (DLP) measures, strict access controls, and comprehensive monitoring of data movement to detect unauthorized exfiltration attempts.