FullBeauty Brands Data Breach 2026 (Everest Ransomware): 4,725 Employee Health Plan Members Exposed. 161 GB Dumped. What To Do

What happened

FullBeauty Brands, Inc. is a New York-based plus-size apparel retailer founded in 1901. Its brand portfolio includes Woman Within, Roaman’s, Catherines, Jessica London, ELOQUII, Avenue, KingSize, BrylaneHome, CUUP, and Swimsuits For All. The company merged with DXL in December 2025 to form a ~$1.2B combined-sales retailer.

FullBeauty Brands is not a healthcare provider — but its self-insured employee group health plan, the “Associate Benefits Plan,” is a HIPAA-covered entity. The HHS OCR filing covers 4,725 plan participants (employees and dependents) whose data was caught in a broader corporate ransomware attack.

Between October 18 and November 19, 2025, an unauthorized actor accessed FullBeauty’s internal network. FullBeauty discovered the intrusion on October 22, 2025. The Everest ransomware group claimed responsibility on its dark-web leak site on November 13, 2025, and on November 24, 2025 Everest published the full ~161 GB data dump after FullBeauty did not meet the ransom deadline.

FullBeauty filed with HHS OCR on January 13, 2026 and mailed individual notification letters on January 16, 2026.

Why this is a HIPAA breach

FullBeauty Brands is not a healthcare provider. But its self-insured employee health plan (“Associate Benefits Plan”) is a HIPAA-covered entity. The retail parent suffered the cyberattack; the benefits-plan filing is the HIPAA-jurisdictional slice — the subset of stolen data containing plan participants’ health insurance and enrollment information.

State AG filings list 1,185 Texas residents, 391 Maine residents, and 6 New Hampshire residents notified, indicating broader employee notifications beyond the HIPAA scope.

What was stolen

Per multiple sources (core):

• Full name
• Social Security number
• Health insurance information
• Health plan enrollment information

Per third-party aggregator (single-source):

• Date of birth
• Home address
• Government IDs
• Medical information

The full ~161 GB Everest data dump remains posted on the group’s leak site and has been scraped and redistributed.

What FullBeauty is offering

• 12 months of complimentary Experian IdentityWorks
• Includes credit monitoring, identity restoration, $1M identity theft insurance
• Call center: 844-354-0077
• Kroll-administered victim portal at cases.ra.kroll.com/FullBeauty/

What to do

1. Enroll in Experian IdentityWorks through the activation code in your letter.
2. Place free credit freezes at Equifax, Experian, TransUnion. Full SSN is in scope, and the data has been published on a public leak site.
3. File IRS Form 14039.
4. Watch for phishing attempts referencing FullBeauty or any of its brands — leak-site data is routinely used in targeted phishing campaigns.
5. If you are a dependent of a FullBeauty employee, monitor your own credit independently — your data was likely included even though the company communicates primarily with the employee.
6. Stop the ongoing flow of your group-health-plan data. HealthConsent files HIPAA restriction requests so the health insurance and enrollment data exposed in this breach is not continuously re-shared.

Continue reading

• Your eight HIPAA rights, in plain English
• Other 2026 healthcare data breaches