Excess Baggage Data Breach

RansomHouse published Excess Baggage on its leak site on October 13, 2026. The UK-based travel and logistics firm joins a data extortion operation active since 2022. The stealer-log data for this victim includes a detail that points directly to phishing, suggesting a sophisticated initial access vector. RansomHouse is a data extortion operation that has been active since 2022. The group is known for publishing victim data without always deploying encryption, focusing purely on extortion. However, ransomware deployment has been observed in recent incidents. In the 60-day window preceding this claim, the group has targeted logistics, retail, and professional services organizations across Europe and North America.

SOCRadar flagged excess-baggage[.]com in stealer-log data sampled before the claim. The returned credentials target two domains: Microsoft 365 / Entra ID (login.microsoftonline[.]com) for corporate identity infrastructure, and crosoftonline[.]com, a typosquat phishing lookalike of Microsoft’s authentication portal. The queried telemetry data is limited to a sample taken before the claim was published. Records dated as recently as September 11, 2026, were identified. The presence of credentials associated with a typosquat domain indicates that employees of Excess Baggage were likely targeted by credential-harvesting phishing campaigns mimicking Microsoft’s login page. These compromised credentials subsequently appeared in criminal markets, and RansomHouse, or an initial access broker supplying them, likely utilized this information to gain access. The absence of stealer-log records in the sampled data does not rule out a compromise. The organization should enforce phishing-resistant MFA on all Microsoft 365 accounts, as standard TOTP authenticator apps are insufficient against the typosquat credential-harvesting technique evidenced here. It is also recommended to review Entra ID sign-in logs for anomalous access patterns from September 2026 onward. Additionally, flag the crosoftonline[.]com domain in DNS filtering tools if it is not already blocked and assess whether any credentials entered on that domain enabled access to internal systems.