What does the alleged Downies ransomware incident tell retailers?
On 21 July 2026, the Settra ransomware group publicly claimed Australian collectables retailer Downies as a victim, alleging the theft of 550 GB of data, publishing sample files and setting a ransom deadline on its leak site. At the time of writing, these claims have not been independently verified or confirmed by Downies. Nevertheless, the incident reflects how double extortion campaigns increasingly target mid-sized Australian retailers, not only large enterprises.
For many retailers, ransomware planning still focuses on a worst-case scenario where systems become encrypted and operations grind to a halt.
That is no longer the whole story.
Today’s ransomware groups are just as interested in stealing information as they are in locking systems. Customer records, financial documents, supplier contracts, employee information and internal communications can all become bargaining chips in an extortion campaign.
The alleged Downies incident demonstrates this shift. According to the Settra group’s public leak site, the attackers claim to have exfiltrated approximately 550 GB of internal data, published sample files and set a deadline before additional information would allegedly be released. While those claims remain unverified, they illustrate the tactics increasingly used by modern ransomware operators to pressure organisations into negotiations.
For Australian retailers, the lesson extends well beyond one organisation. The real business impact often begins long before systems are encrypted and continues long after operations have been restored.
What Happened?
On 21 July 2026, the Settra ransomware group added Downies Collectables to its public leak site.
The post alleged that the group had stolen approximately 550 GB of company data, published sample documents and established a ransom deadline, threatening to release additional information if negotiations were unsuccessful. Public ransomware tracking services subsequently recorded the listing as an unconfirmed claim, noting there was no public confirmation from the organisation at the time of writing.
It is important to distinguish between an attacker claim and a confirmed cyber incident.
Ransomware groups frequently publish organisations on leak sites before investigations are complete. In some cases, claims are later substantiated. In others, organisations deny compromise or determine that attackers exaggerated the extent of their access.
For security leaders, however, the tactical lessons remain the same regardless of the eventual outcome.
The existence of a public leak site, sample data and a ransom deadline demonstrates how ransomware groups increasingly rely on reputational pressure rather than encryption alone.
How Double Extortion Works
Traditional ransomware relied primarily on encryption.
Attackers prevented organisations from accessing systems and demanded payment in exchange for a decryption key.
Modern ransomware operations have evolved considerably.
Today, many groups conduct data exfiltration before deploying ransomware or, in some cases, without encrypting systems at all. The attack typically follows three stages:
- Gain access to the environment.
- Steal sensitive information.
- Threaten to publish the stolen data on a ransomware leak site if payment is not made.
This approach is known as double extortion.
Even if an organisation can restore systems from backups, stolen customer information, financial records or intellectual property cannot simply be recovered. Once data has left the environment, organisations face reputational, legal and regulatory challenges that backups alone cannot solve.
Leak sites amplify this pressure by creating public deadlines, publishing sample files and encouraging media attention before investigations have concluded.
Why Mid-Sized Australian Retailers Are Being Targeted
Retailers remain attractive targets because they manage large volumes of valuable information.
Depending on the business, this may include:
- Customer names and contact details
- Purchase histories
- Loyalty programme information
- Employee records
- Supplier contracts
- Financial documents
- Payment processing environments
Many mid-sized retailers have expanded rapidly through e-commerce, cloud platforms and digital payment systems.
While these technologies improve customer experience, they also increase the number of identities, applications and internet-facing assets that attackers can target.
Unlike large enterprises with dedicated cyber security teams operating around the clock, mid-sized retailers often face tighter budgets and fewer specialised security resources.
Attackers understand this.
They are increasingly looking for organisations that hold commercially valuable information while lacking the same level of security maturity found in larger enterprises.
Retailers processing payment information also need to consider obligations under PCI DSS, while businesses collecting personal information must manage their responsibilities under Australia’s privacy framework. These requirements make customer data an especially valuable target for extortion campaigns.
The Real Cost Goes Beyond the Ransom
When ransomware dominates headlines, attention often focuses on whether an organisation paid.
In reality, the ransom itself may represent only a fraction of the overall business impact.
If personal information is affected, organisations may need to assess whether the incident meets the threshold for an eligible data breach under Australia’s Notifiable Data Breaches Scheme administered by the Office of the Australian Information Commissioner (OAIC). This includes assessing suspected breaches and notifying affected individuals where required.
Other costs frequently include:
- Incident response and forensic investigations
- Legal and regulatory advice
- Customer notifications
- Credit monitoring services
- Business interruption
- Reputational damage
- Loss of customer confidence
- Increased fraud and phishing campaigns using stolen information
For retailers, customer trust is often one of the organisation’s most valuable assets.
Once confidence is damaged, rebuilding it may take considerably longer than restoring IT systems.
Why Retailers Need to Think Like Attackers Before Attackers Think Like Them
Most organisations already conduct vulnerability assessments and penetration testing.
These activities remain important.
However, sophisticated ransomware groups rarely rely on a single technical vulnerability.
They chain together multiple weaknesses involving identities, cloud services, exposed applications, privileged accounts and human behaviour.
This is where red teaming and attack simulations become particularly valuable.
Rather than identifying isolated vulnerabilities, red teaming replicates how real attackers move through an environment to determine whether existing security controls can detect, delay and stop an intrusion before sensitive data is exfiltrated.
For retailers, this provides insight into questions such as:
- Could an attacker reach customer databases?
- Would suspicious activity be detected early?
- Are privileged accounts sufficiently protected?
- Can sensitive information be exfiltrated without triggering alerts?
- Would security teams identify lateral movement before extortion begins?
Testing these scenarios proactively allows organisations to address weaknesses before they become real incidents.
Retailers should also regularly review their consumer data protection practices to ensure customer information is appropriately classified, secured and accessible only to authorised personnel.
What To Do During the First 24 Hours
Whether a ransomware claim originates from internal detection, law enforcement or an attacker leak site, the first day is critical.
Organisations should prioritise:
- Activating their incident response plan.
- Preserving evidence before making major system changes.
- Engaging digital forensics specialists.
- Validating whether unauthorised access occurred.
- Assessing whether data exfiltration may have taken place.
- Restricting compromised accounts and privileged access.
- Engaging legal, executive and communications teams.
- Considering regulatory notification obligations where appropriate.
Equally important is resisting the temptation to rely solely on attacker claims.
Investigations should establish what evidence actually supports before public statements are made.
Frequently Asked Questions
Is the Downies ransomware attack confirmed?
At the time of writing, no. The incident is based on a public claim published by the Settra ransomware group’s leak site. Public ransomware tracking services classify the listing as an unconfirmed claim, and no public confirmation from Downies had been identified when this article was prepared.
What is double extortion in ransomware?
Double extortion combines data theft with ransomware. Attackers first exfiltrate sensitive information before encrypting systems, then threaten to publish or sell the stolen data if a ransom is not paid. This approach creates additional pressure even when organisations have reliable backups.
Does an Australian retailer have to report a ransomware data breach?
Potentially. Organisations subject to Australia’s Privacy Act should assess whether an incident constitutes an eligible data breach under the OAIC’s Notifiable Data Breaches Scheme. Where serious harm is likely, affected individuals and the OAIC may need to be notified following the required assessment process.
How can retailers reduce ransomware risk?
Retailers should implement strong identity security, network segmentation, multi-factor authentication, tested backups, continuous monitoring, an exercised incident response plan and regular red teaming and attack simulations to identify attack paths before criminals exploit them.
Conclusion
Whether the alleged Downies incident is ultimately confirmed or not, it reflects the direction ransomware operations continue to take. Public leak sites, alleged data exfiltration and ransom deadlines have become central components of modern extortion campaigns, placing pressure on organisations long before investigations conclude.
For Australian retailers, resilience is no longer measured solely by the ability to recover encrypted systems. It also depends on protecting customer information, limiting opportunities for data exfiltration and detecting attacker activity before sensitive information leaves the environment.
The organisations best prepared for modern ransomware are those that continually test their defences from an attacker’s perspective, strengthen customer data protection and maintain incident response capabilities that are ready before they are needed.
How Intrix Can Help
At Intrix, we help Australian retailers identify and reduce the attack paths that modern ransomware groups rely on.
Our red teaming and attack simulations evaluate how a determined attacker could move through your environment, compromise privileged accounts and reach sensitive customer data. By simulating real-world adversary techniques, we help organisations identify weaknesses that traditional security assessments may overlook before they can be exploited.
We also help businesses strengthen their consumer data protection strategies by assessing how sensitive information is stored, accessed and protected across cloud platforms, business applications and internal systems. Combined with proactive security testing and incident response planning, these services help organisations reduce both the likelihood and impact of modern ransomware attacks. Contact us now.
