A ransomware group calling itself Rhysida claims to have obtained data from Rug & Home, according to a listing on the group’s own leak site dated September 7, 2026. This claim was tracked by ransomware.live, a security research platform that monitors ransomware groups’ public leak sites, and has not been independently verified by BreachLetter, by Rug & Home, or by any regulator.
What we know — and don’t
- Rhysida posted a claim referencing Rug & Home on its leak site with a claimed date of September 7, 2026.
- Rug & Home operates in the retail sector, based on publicly available information about the company’s business activity.
- The specific data types Rhysida claims to have obtained have not been disclosed in the listing and have not been confirmed by Rug & Home or any independent party.
- No official statement from Rug & Home or notification to regulators has been identified at this time.
- As with all leak-site postings, the claim could be exaggerated, unverified, or entirely false; ransomware groups have financial incentives to overstate their access.
What should you do if you have an account with this company?
- Change your password for any account associated with Rug & Home, and avoid reusing that password elsewhere.
- Enable two-factor authentication (2FA) on your account if it is offered and not already active.
- Watch closely for phishing emails or texts that reference Rug & Home, recent orders, or account verification requests — attackers often use claimed breaches as bait.
- Avoid clicking links in unsolicited messages; instead, navigate directly to the company’s official site or app.
- Consider monitoring your personal information for misuse, since a service like Aura or LifeLock identity monitoring services can help flag suspicious activity tied to your name, email, or financial accounts.
- Keep an eye on bank and card statements for unfamiliar charges in the weeks following any claimed incident.
BreachLetter will update this page if Rug & Home confirms this incident, issues a public statement, or if the matter is officially reported to regulators.