Family Farm and Home was named on November 28, 2025 as a victim of the WorldLeaks ransomware group, a threat actor that emerged in early 2025 as a rebrand of the former Hunters International operation. The attackers stole internal data and posted the company on their dark-web leak site to pressure payment.\n\nInitial reporting put the total scope at roughly 1.3 million records, with about 755,000 unique email addresses, 1.3 million phone numbers, and around 8,100 Social Security numbers among the stolen data. The breach appears to mix customer contact information with employee records, since retailers of this kind do not typically collect Social Security numbers from customers. The SSN subset is therefore most likely tied to current and former staff. The attack followed the WorldLeaks playbook of data theft and public extortion rather than file encryption.\n\nAffected individuals face two distinct risk profiles. Customers whose contact information was exposed should expect targeted phishing and SMS scams referencing recent purchases. The smaller employee subset whose Social Security numbers were taken faces materially higher risk: identity theft, fraudulent credit applications, and tax-return fraud. Anyone potentially in that group should freeze credit at all three U.S. bureaus, monitor IRS activity for fraudulent filings, and treat any unsolicited contact claiming to be from a creditor or government agency with caution.

Regional retail chains collect customer names, emails, phone numbers, addresses, purchase history, loyalty records, and payment-adjacent data across e-commerce and in-store service operations.

Family Farm and Home was named publicly by the WorldLeaks ransomware group on November 28, 2025, after threat actors stole internal data. The company has not yet issued a detailed public statement about the incident. U.S. plaintiffs' law firms initiated class-action investigations in mid-December 2025, though no settlement or formal class certification has been reported as of early 2026. The retail business continues to operate normally through its store network and online channel, and the company has not publicly indicated any operational disruption beyond the data exposure itself.