MyPillow listed on ransomware gang’s leak site, but denies it has been breached

The ransomware group known as Play is claiming to have exfiltrated data from the US-based pillow manufacturer MyPillow. The group posted on its dark web leak site that it had obtained private and personal confidential information. Play threatened to release an unspecified amount of this data on Friday, potentially exposing documents related to clients, budgets, payroll, identification, taxes, and financial information.

However, MyPillow's CEO, Mike Lindell, has refuted these claims, stating that the company has not experienced any security breach. Lindell, who is also a prominent supporter of former President Donald Trump and is seeking the Republican nomination for governor of Minnesota, told Straight Arrow News that he was unaware of any alleged attack until contacted by the press. He suggested that the accusations are politically motivated, calling it a "hit job" due to his gubernatorial campaign. Lindell asserted that MyPillow has no data breaches and does not store sensitive information internally, relying instead on third-party providers.

The veracity of Play's claims remains unconfirmed. MyPillow denies a breach, while the ransomware group insists otherwise. The situation is expected to become clearer by Friday, the deadline set by Play for an undeclared payment. If the data is not released after this deadline, it could indicate that the attackers do not possess MyPillow data or were compensated to withhold it.

Experts caution that a company's assertion of not holding sensitive data on its own systems does not negate the risk of a breach. Modern businesses frequently share customer records, payroll, and financial details with various third-party vendors, including payment processors, fulfillment partners, HR and payroll services, and cloud hosting providers. These external systems can also be targeted by attackers, as a single compromise can yield data from multiple organizations.

From the perspective of individuals whose data might be at risk, such as customers or employees, the distinction between a breach occurring on a company's own servers or those of a contractor is largely irrelevant. If personal information like names, addresses, payment details, or tax information appears on a ransomware leak site, the source of the compromise has minimal practical impact on the affected individuals. Outsourcing data storage and processing does not shield a business from reputational damage or lessen the severity of consequences for those whose data is exposed.

The outcome of Play's threat will likely be revealed by Friday. Ransomware groups typically target organizations they believe may be willing to pay, underscoring the need for robust security defenses across all businesses.