Spijkermat listed on Radiant ransomware leak site

• Ransomware group: Radiant
• Country: Netherlands
• Sector: Retail & E-Commerce
• Announcement date: October 29, 2025

Radiant claims data breach at Spijkermat

The Radiant threat group has listed the Dutch organization Spijkermat on its leak site, claiming to have successfully obtained sensitive data from the company. This announcement, made on October 29, 2025, follows the group's claim of having gained access to the organization's internal data. While the group has posted the listing, public information regarding the specific identity and operational details of the Radiant group remains limited.

In many modern cyberattacks, threat actors utilize a tactic known as double extortion. This method involves not only encrypting an organization's systems to disrupt operations but also exfiltrating sensitive information. The attackers then threaten to leak this stolen data on public forums or dedicated leak sites if their demands are not met. This strategy increases the pressure on the victim, as the threat of a public data exposure can cause significant reputational and regulatory damage.

Details of the alleged data theft

According to the announcement made by the Radiant group, the stolen information is quite extensive and covers various aspects of the company's operations and personnel. The group claims to have access to a variety of sensitive documents and records that could be used for malicious purposes. The specific types of data mentioned in the claim include:

• BSN (Citizen service numbers)
• Tax information
• Supplier agreements
• Accounting records
• Staff payrolls
• Email correspondence

The presence of such diverse data types—ranging from financial records to personal identification numbers—suggests a broad intrusion into the organization's digital infrastructure. It is important to note that the specific volume of the data and the total number of files involved have not been disclosed by the threat actors.

About Spijkermat

Spijkermat is a retail company based in the Netherlands. The organization specializes in the sale of acupressure mats, which are products designed to assist customers with relaxation, the alleviation of pain, and the improvement of sleep quality.

Potential implications and organizational risks

The alleged leak of this specific dataset poses several significant risks to the organization, its employees, and its business partners. The inclusion of BSN numbers and payroll information is particularly concerning, as it may expose individuals to identity theft or highly targeted phishing attacks. Furthermore, the exposure of supplier agreements and accounting records could compromise the company's commercial relationships and operational integrity.

Because Spijkermat is based in the Netherlands, this incident may lead to complex compliance issues under the GDPR (EU General Data Protection Regulation). Such regulations impose strict requirements on how personal data must be protected and how breaches must be reported. A confirmed leak of this nature could impact the organization's business operations and its overall reputation in the retail market.

When organizations face these types of threats, defensive strategies often involve reviewing and strengthening data security protocols. Common industry practices for mitigating such risks include implementing multi-factor authentication, maintaining strict access controls, and conducting regular security audits. If the claims made by the Radiant group are verified, the organization may need to undertake a comprehensive review of its security posture to prevent future occurrences.