Skip to content
Leak-site post naming EWM Group, captured by ThreatCluster

EWM Group

aurora

Ransomware leak-site victim intelligence

Data size
503,878 loyalty programme member records; ~21,000 employee r
Files
7
Views
8,724
Posted
Oct 28, 2026
Countdown
3 days 11 hours 33 min 39 sec
Country
GB
Industry
fashion

Summary

Written by ThreatClusterfrom site fields, file listing, victim profile, leak post, screenshot

The leak post claims that 503,878 loyalty-programme member records and about 21,000 employee records were taken from EWM Group, along with Outlook PST email archives, SQL Server backups, and e-commerce transaction data. The leak page identifies the victim as EWM Group, the parent of Bonmarché, Edinburgh Woollen Mill, and Peacocks, with domain www.peacocks.co.uk. The publication status is countdown, with 5 days, 0 hours, 54 minutes remaining.

Describes what the group claims on its leak site. A listing is not confirmation that a breach occurred.

Victim profile

Employees
0

What was taken

EWM Group — the parent group behind Bonmarché, Edinburgh Woollen Mill, and Peacocks, three of the UK's best-known value fashion chains.

Data categories
loyalty program dataemployee recordsemail archivese-commerce datadatabase backupspersonal data
File types seen
csv × 1key × 1pfx × 1sql × 1txt × 1docx × 2
Sample files (7)
Cybertill Administrator Password and IP Settings.docx
ewmg-passwords.docx
ChromePasswords-PaulGleave.csv
rl_sql_resetdefaultpassword.sql
BONWC2025SSL.pfx
S1.txt
prodzellisjwtRS256.key

Also stated on the leak page

Fields this group publishes that do not map to a standard column. Labels are the site's own.

Phone
0330 124 2184 (tel:0330 124 2184)
YouTube
https://www.youtube.com/channel/UC3GffS_jMPYqHGXNSUvQw9g
Facebook
https://www.facebook.com/peacocksclothing
Instagram
https://www.instagram.com/peacocks_fashion/
Data Publishing
5 days : 00 hours : 54 min : 00 sec

Leak-site images (2)

Images from the victim's leak listing. Thumbnails scraped from the onion page are blurred by default — click a thumbnail to view.

ThreatCluster capture
onion leak page5.3 KB