Magasin du Nord · Breach

Extortion group dumps 70 GB from Danish retailer Magasin du Nord

Nov 05, 2026 · 1 min read

A group calling itself majinahanashi claims to have published more than 280,000 files (about 70 GB) stolen from Magasin du Nord, Denmark's oldest department store chain. The group says it offered a working decryptor, test files and two deadline extensions before negotiations collapsed. The post notes the company confirmed the incident in October.

By HIFY Radar newsroom Updated 11/05/2026 02:14 AM Get this every day →← Back to the feed 1 source

MediumBreachNo software to update

In this article

What happened
Why it matters
What to do
For the technical team
Timeline
Sources

What happened

An extortion group calling itself majinahanashi claims to have published about 70 GB (more than 280,000 files) stolen from Magasin du Nord, Denmark's oldest department store chain. The company confirmed an October ransomware attack that encrypted parts of its IT systems. On Nov 3 it said confidential data on current and former employees was accessed. The publication of the data is a claim by the group and has not been independently verified.

Why it matters

According to the company, confidential data on current and former employees was accessed; so far there is no sign that customer data was leaked. If the leak is real, the exposed data can fuel targeted phishing and identity fraud against employees and Goodie club members. The case shows the cost of a ransomware attack once extortion talks collapse.

What to do

Advise current and former employees and Goodie club members to watch for targeted phishing and identity fraud. Treat the published dump as unverified until its contents are confirmed. Monitor leak channels and respond based on what is confirmed.

For the technical team

Affected: Magasin du Nord (magasin.dk), cadeia de lojas de departamento mais antiga e conhecida da Dinamarca; grupo de extorsão 'm · Magasin du Nord (magasin.dk). Per the company, confidential data on current and former employees was accessed; no sign of customer data being leaked found so far.
Exploitation: The group calling itself majinahanashi claims to have published more than 280,000 files (about 70 GB) and has marked the data as leaked. Claim not independently verified, reported by DailyDarkWeb. The underlying ransomware incident is confirmed by the company itself.
Fix: Not applicable; extortion and data leak incident with no software fix.
Vector: Ransomware encrypted parts of Magasin du Nord's IT systems, confirmed by the company in October. Initial access vector not disclosed.
More details: The group says it offered a working decryptor, test files and two deadline extensions before talks collapsed. Timeline per the source: the company confirmed ransomware in October; on Nov 3 it confirmed employee data was accessed. DailyDarkWeb's analyst recommends current and former staff and Goodie club members watch for targeted phishing and identity fraud.