Lighting Direct Data Breach

Lighting Direct, a New Zealand-based online lighting retailer, has been listed as a victim on the dark web extortion portal operated by thegentlemen ransomware group as of November 5, 2026. SOCRadar Dark Web Monitoring identified the listing on the group’s leak site. As an e-commerce retailer operating in the Asia-Pacific region, Lighting Direct handles a steady flow of customer account credentials, payment, and registration data across its online storefront, an environment that can attract ransomware and extortion activity targeting retail platforms and their customer-facing authentication infrastructure. The listing comes amid sustained activity from thegentlemen, which has claimed 244 victims over the past 60 days, with its targeting concentrated in Manufacturing, Healthcare, and Technology. The group’s recent victim list leans heavily toward English-speaking markets, with comparable listings including Bi Link (US), CommTank (US, Technology), NOVADATA (Argentina, Technology), and SK Capital Partners (US, Financial Services). Lighting Direct does not fit the group’s core targeting profile: it is an Asia-Pacific e-commerce target in a campaign otherwise anchored in North Atlantic economies, making the New Zealand retail claim a geographic outlier for a group operating primarily across the US, UK, and Canada.

SOCRadar’s stealer-log telemetry returned 15 records tied to the lightingdirect[.]co.nz domain. All 15 records are consumer accounts, captured from login, checkout, and account-creation endpoints on the e-commerce platform. The log window runs from February 2024 through October 2026 — 32 months of customer account access spanning authentication, payment, and registration flows — with no sign of credential rotation during that period. No employee credentials appear in the sample, and the dominant risk profile is customer account takeover and supplier risk, with the logs spanning 2024-02-05 to 2026-10-09. These findings reflect only the dataset queried by SOCRadar’s stealer-log telemetry, and the absence of employee credentials in the sample does not confirm that the organization is unaffected. Records may exist outside the queried feeds, credentials may have been used and rotated before indexing, data may not yet have been indexed, and corporate access may exist under alternate domains or personal email aliases not captured here. Infostealer-harvested credentials can also support ransomware operations: validated corporate credentials sold through underground marketplaces or brokered to initial access groups may enable access to corporate accounts, Microsoft 365 environments, VPNs, or remote-access portals, which can in turn be leveraged for ransomware deployment. No such access method has been confirmed in this incident, and this remains a possible rather than observed intrusion path. The e-commerce authentication layer warrants priority review given that customer account passwords are likely in circulation on underground markets. Affected customer accounts should have credentials reset, with enhanced monitoring applied to login and checkout endpoints. Continued dark web and stealer-log monitoring, proactive credential-hygiene checks, multi-factor authentication review, and review of Microsoft 365, VPN, and remote-access activity are recommended to detect any potential misuse of exposed credentials.