As part of Cyble darkweb and deepweb monitoring, our research team came across the post by Netwalker ransomware operators where they have claimed to be in possession of confidential data of Regatta which is Britain’s outdoor clothing and footwear brand with over 1700 employees; Regatta’s annual revenue is around $325 million.
Editor’s Note (Updated 2026): This report reflects information available at the time of original publication in July 2020. For current insight into how dark web monitoring and brand protection solutions help organizations detect this kind of exposure earlier, see Cyble’s Brand Intelligence & Protection solution.
A ransomware is a form of malware that encrypts the files of its victims and demands a ransom to unencrypt those files and restore victim’s access after payment.
Below is the screenshot of the message posted by the NetWalker ransomware operators on their online blog-:
Currently, the ransomware operators have leaked a sample of the data leak which seems to include the bank details of vendors, bank reconciliations statements, company’s accounting documents, customer’s details, and much more. Below are the snapshots of the sample of the data leak of Regatta.
Netwalker operators have claimed to release the data of Regatta after 9 days.
Tips on how to prevent ransomware attacks –
- Never click on unverified/unidentified links
- Do not open untrusted email attachments
- Only download from sites you trust
- Never use unfamiliar USBs
- Use security software and keep it updated
- Backup your data periodically
- Isolate the infected system from the network
- Use mail server content scanning and filtering
It is recommended to follow the above-mentioned prevention methods and never pay the ransom. Beyond internal prevention, brand protection solutions that monitor dark web forums and leak sites — like the one that surfaced this Regatta claim — help organizations catch this kind of exposure before it escalates into a public data leak.
Frequently Asked Questions
1. What is Netwalker ransomware?
Netwalker was a ransomware-as-a-service operation active from 2019 into 2021, known for encrypting victim files and threatening to publish stolen data on a dark web leak site if the ransom wasn’t paid.
2. What data did the Netwalker operators claim to have stolen from Regatta?
The leaked samples reportedly included vendor bank details, bank reconciliation statements, company accounting documents, and customer information.
3. How is this kind of leak typically discovered?
Incidents like this are often surfaced through dark web and deep web monitoring, which tracks ransomware operator blogs and leak sites for mentions of a specific organization before the exposure becomes widely public.
About Cyble
Cyble is a Cupertino, California-based, AI-native cybersecurity company providing real-time threat intelligence, attack surface management, brand intelligence and protection, and dark web monitoring to organizations worldwide.
Cyble’s platforms combine machine learning with human analyst review to give security teams early visibility into threats — including data leaks, brand impersonation, and third-party risk — often before they become public incidents. Cyble has since been recognized by Gartner, Forrester, and G2, among others, for its threat intelligence and brand intelligence capabilities.
