Custom Bakehouse Data Breach

Custom Bakehouse, a US specialty food retailer and wholesale bakery, has been listed on Dark Project ransomware’s dark web portal as of November 5, 2026. The listing was identified through SOCRadar Dark Web Monitoring. Dark Project is a comparatively smaller ransomware operation, and the victim’s profile as a US-based retail and food production company aligns closely with the sectors the group has concentrated on in its recent activity, making the listing consistent with the group’s established targeting pattern. In the past 60 days, Dark Project has claimed 9 other victims, with a concentration in US Retail & E-Commerce, Manufacturing, and Agriculture and Food Production, with additional activity observed in Turkey. The group’s recent US food and retail cluster includes Simplehuman (US, Retail & E-Commerce), Claire’s Inc. (US, Retail & E-Commerce), Homestead Creamery (US, Agriculture and Food Production), and Food Bank of Central Louisiana (US, Agriculture and Food Production). Custom Bakehouse’s wholesale model puts it in similar company, fitting squarely within that pattern of US retail and food sector targeting.

SOCRadar’s stealer-log telemetry returned 20 records for the custombakehouse[.]com domain. Of these, eleven are external-user accounts belonging to wholesale business customers and suppliers accessing the company’s wholesale ordering portal. Distinct external business identities appear across authentication and account-registration endpoints, with logs spanning December 2025 through November 2026 — eleven months without credential rotation. The dominant exposure profile is customer account takeover and supplier risk, with logs spanning 2025-12-11 to 2026-11-04. It is important to note that these are supplier and customer accounts, not employee credentials. However, eleven months of wholesale portal credentials circulating in stealer-log feeds is a signal worth acting on. While the presence of these records does not confirm that the group’s intrusion path relied on this credential exposure, infostealer-harvested credentials for a business-facing ordering portal can potentially be validated and monetized through underground marketplaces or leveraged directly for unauthorized portal access. The absence of employee credentials in the queried dataset also does not rule out exposure under alternate corporate domains, personal email aliases, or in feeds outside the dataset queried; credentials may likewise have been used and rotated before indexing, or may not yet have been indexed. All wholesale portal credentials should be treated as potentially compromised. Affected supplier and customer organizations should rotate their access credentials, and multi-factor authentication protections for the wholesale ordering portal warrant review. The company’s authentication layer warrants a review for anomalous login patterns over the past year, and continued dark web and stealer-log monitoring is advisable to detect additional records as they surface.