In August 2022, Bombardier Recreational Products Inc. (BRP) fell victim to a ransomware attack executed by the RansomEXX gang, which severely disrupted its operations for multiple days. Initially, BRP acknowledged the incident as malicious cyberactivity and implemented containment measures. However, it was later confirmed that an unauthorized third party had accessed and leaked sensitive data on the dark web. The breach involved 29.9GB of stolen files, including non-disclosure agreements, passports, IDs, contracts, and supply agreements—compromising both employee and supplier information.The attack not only exposed critical internal and third-party data but also caused operational paralysis, halting business functions temporarily. The leaked data posed significant risks, including potential fraud, reputational damage, and legal repercussions due to the exposure of personally identifiable information (PII) and confidential business documents. The incident underscored the severe consequences of ransomware-driven data exfiltration, particularly when combined with operational disruption and the public disclosure of sensitive corporate and personal records.