✨ The Containment Era is here. Secure AI workloads before they breach. →The Containment Era is here. →The Containment Era is here. →Explore ✨
Retail Industry
Breach intelligence, attack campaigns, and threat reports targeting the Retail Industry sector.
Explore Other Sectors
Retail Industry Threat Reports
Salesforce 2025 Supply Chain Data Breach: An Executive Overview
In 2025, Salesforce and hundreds of its customers were targeted in two coordinated data theft campaigns by the threat group "Scattered Lapsus$ Hunters," leveraging both social engineering and stolen OAuth tokens. Attackers tricked employees into connecting malicious OAuth applications or exploited compromised Salesloft Drift tokens, gaining unauthorized access to sensitive CRM data, support tickets, credentials, and authentication tokens. The attackers subsequently attempted to extort 39 major organizations, threatening to leak up to 1.5 billion records via a dark web leak site unless sizable ransom demands were met. Salesforce publicly refused to negotiate or pay any ransom, and law enforcement actions appeared to subsequently seize the extortion domain. This incident underscores the growing sophistication of supply-chain attacks using identity-based and OAuth token compromise, highlighting the rising risk to SaaS ecosystems. The event triggered significant concerns across industries that increasingly rely on interconnected third-party platforms and further emphasizes urgent gaps in SaaS security, zero trust application governing, and lateral movement prevention.
6 months ago
Kill Chain
How Qilin Ransomware Disrupted Asahi’s Breweries in 2025
In late September 2025, Japanese beer giant Asahi fell victim to a major ransomware attack attributed to the Qilin cybercrime group. The attack began on September 29, disabling operations at six of Asahi's Japan-based breweries and resulting in the suspension of production for their flagship and other beer labels. Investigation confirmed that the attackers exfiltrated approximately 27GB of sensitive data, including internal financial documents, employee ID records, and confidential contracts. Qilin publicly claimed responsibility after failed ransom negotiations, leaking data and amplifying operational impacts. The incident forced Asahi to adopt manual processes, delaying product launches and potentially causing an estimated $335 million in financial losses. This breach underscores a persistent and rising trend of ransomware actors targeting large manufacturers by exploiting vulnerable edge devices and employing data theft for leverage. The Qilin group’s evolving tactics—linked to both organized cybercrime and nation-state affiliates—reflect the growing complexity of ransomware risks facing critical supply chain and manufacturing sectors in 2025.
6 months ago
Kill Chain
ShinyHunters Extorts 39 Firms in Salesforce OAuth Supply Chain Breach
In October 2025, the extortion group known as 'Scattered Lapsus$ Hunters'—a coalition including ShinyHunters, Scattered Spider, and Lapsus$—launched a data leak site to extort 39 companies after a coordinated campaign exploiting Salesforce OAuth integrations. The attackers used sophisticated voice phishing to trick employees into connecting malicious OAuth apps to corporate Salesforce instances, enabling unauthorized database access. Stolen data included sensitive customer records from major global brands such as FedEx, Disney, Google, and Marriott, with threat actors demanding ransom to prevent broader public disclosure. Salesforce stated there was no compromise of its platform, but investigations continue. This incident highlights the rising threat of supply chain and identity-based attacks targeting SaaS platforms, exploiting user trust and third-party integrations. With the growing adoption of SaaS solutions and increasing regulatory focus (e.g., GDPR), enterprises face mounting pressure to implement robust identity, access governance, and monitoring controls to defend against mass-scale data exfiltration and extortion.
6 months ago
Kill Chain
Motility Software Suffers Major Ransomware Breach Impacting Over 766,000 Clients
In June 2024, Motility Software Solutions, a prominent provider of dealer management software, suffered a ransomware attack that resulted in the unauthorized access and exposure of sensitive data from approximately 766,000 clients. The attackers infiltrated Motility's networks, deployed ransomware to encrypt critical systems, and exfiltrated customer data, including personal and financial information. The attack caused significant operational disruptions for both Motility and its dealership clients, who rely on the platform for daily business operations. The incident highlights the persistent threat ransomware actors pose to software supply chains serving multiple downstream businesses. This breach is especially noteworthy amid an ongoing rise in ransomware targeting SaaS and vertical market providers, with attackers prioritizing data exfiltration for extortion. Regulators and business partners are increasing their demands for improved security controls and rapid incident disclosure, especially for service providers entrusted with large volumes of sensitive client data.
6 months ago
Kill Chain
Harrods Suffers Major Supply Chain Breach: 430,000 Customer Records Exposed in 2025
In September 2025, UK luxury retailer Harrods disclosed a major cybersecurity incident after attackers exploited a vulnerability in a third-party supplier, leading to the exposure of 430,000 e-commerce customer records. The breach, unrelated to earlier attacks by Scattered Spider, leveraged a supply chain vector similar to the widespread Salesloft OAuth attack, allowing data exfiltration from connected Salesforce environments. Compromised data included names, contact information, and internal marketing labels, but excluded financial data and passwords. Harrods responded by promptly notifying affected customers and authorities, while refusing to engage with extortion attempts by the threat actor. This incident illustrates the growing risk of supply chain compromise in the retail and e-commerce sector, where attackers increasingly exploit third-party platforms for large-scale data theft. As regulatory scrutiny intensifies and similar attacks proliferate, organizations must reevaluate supply chain security controls and customer notification protocols.
6 months ago
Kill Chain
Asahi Group 2025: Ransomware Attack Halts Japan's Largest Brewer
In September 2025, Asahi Group Holdings, Japan's largest brewer, suffered a significant cyberattack impacting its Japan-based operations. The attack disrupted critical business functions including ordering, shipping, call center operations, and customer service, forcing a suspension of core activities across the country. Initial reports confirm this was caused by a ransomware incident, though the initial point of entry and perpetrating threat actor remain unconfirmed. As of now, no data leakage or ransom claims have been validated, and the root cause is under active investigation. This incident highlights the expanding risk ransomware poses to critical manufacturing and supply chain operations, especially in the food and beverage sector. The Asahi attack underscores the importance of securing operational technology, internal communications, and implementing robust incident response plans amidst growing threats to large multinational enterprises.
6 months ago
Kill Chain
Inside the 2025 Co-op Scattered Spider Cyberattack: Lessons and Impact
In April 2025, the Co-operative Group (Co-op), a major UK member-owned retailer, experienced a sophisticated cyberattack attributed to Scattered Spider affiliates linked to the DragonForce ransomware operation. The attack targeted Co-op’s IT infrastructure, forcing the group to shut down critical systems, causing major disruptions to back-office and call-center operations, and necessitating rapid manual workarounds. Although Co-op's incident response prevented data encryption, attackers stole sensitive personal information of all 6.5 million current and past members, including names and contact details. The breach resulted in significant operational outages, with £80 million ($107 million USD) in immediate financial losses and longer-term revenue reduction due to impacted retail operations and customer trust. This incident highlights the evolving threat of identity-driven ransomware attacks and the increasing willingness of threat actors to disrupt critical infrastructure for financial gain. The scale and impact of the Co-op breach underscore the need for advanced security controls and segmented, resilient architectures to counter modern ransomware groups.
6 months ago
Kill Chain
Persistent Exploitation of Hikvision Camera Vulnerabilities (2017–2025): Lessons for IoT Security
Between 2017 and 2025, waves of exploit attempts have targeted Hikvision IP cameras using vulnerabilities such as CVE-2017-7921. Attackers abused easily guessable or default credentials passed via HTTP GET parameters, leveraging weak authentication mechanisms to access sensitive camera endpoints, user configurations, and device data. The entry vector relied on IoT device misconfigurations and insecure design, while brute-force attempts and credential stuffing remain prevalent. This activity has potential to expose live feeds, user data, and create a foothold into internal networks, with implications for privacy, compliance, and physical security. This breach is notable today as attempts to exploit Hikvision and similar IoT cameras continue at scale, highlighting persistent IoT security challenges due to poor credential hygiene, slow patch adoption, and device interface limitations. The incident demonstrates ongoing risk as attackers increasingly automate targeting of legacy and unpatched embedded devices across global networks.
6 months ago
Kill Chain
Iframe Security Exposed: The 2025 Rise of Payment Skimmer Attacks
In September 2025, a widespread web application attack exploited payment iframes across major online retailers to deploy advanced payment skimmer malware. Attackers leveraged vulnerabilities in embedded iframe components on e-commerce checkout pages, bypassing client-side security controls and web isolation policies to secretly harvest customer credit card data. The campaign remained undetected for weeks, affecting thousands of transactions globally and prompting emergency mitigation efforts, reputational impact, and regulatory scrutiny for affected organizations. This incident highlights the urgent need for stronger web application and iframe security, as payment skimming through novel overlay techniques continues to surge. Organizations are under increased regulatory pressure to harden PCI compliance and prevent supply chain-driven client-side attacks.
6 months ago
Kill Chain
DPRK Leverages ClickFix Job Scams to Infest Crypto Firms with BeaverTail Infostealer
In September 2025, threat actors linked to North Korea (DPRK) orchestrated a targeted phishing campaign leveraging ClickFix-style lures against employees in the cryptocurrency and retail sectors. Masquerading as legitimate job opportunities for marketing and trader roles, attackers distributed malicious files leading to infection with BeaverTail and InvisibleFerret malware. This allowed adversaries to employ infostealing techniques, facilitating lateral movement and potential data exfiltration, while avoiding traditional security controls. The campaign highlights DPRK’s continued focus on crypto-enabled theft, using sophisticated social engineering, custom tooling, and industry-specific targeting. This incident underscores a recent surge in state-sponsored campaigns prioritizing non-technical roles and leveraging advanced lure techniques. Organizations in high-value verticals like crypto are increasingly attractive to financially motivated adversaries, elevating the urgency for zero trust defenses and robust internal traffic security controls.
6 months ago
Kill Chain
Scattered Spider Strikes: 2024 Ransomware Attack on Transport for London Exposes Critical Gaps
In August 2024, Transport for London (TfL), a critical national infrastructure operator in the UK, suffered a significant ransomware attack attributed to the 'Scattered Spider' cybercrime collective. Law enforcement arrested two UK-based teenagers, believed to be key members of the group, after evidence tied them to not just the TfL breach but also a string of attacks targeting US healthcare and federal systems. The ransomware event caused extensive disruption to TfL’s internal and online systems, delayed refund processing, and ultimately led to a breach of customer data, including names, contact details, and addresses. Financial losses for TfL ran into the millions. This incident highlights both the growing capability and brazenness of young, English-speaking cybercriminals, as well as the expanding impact of ransomware on critical infrastructure and global enterprises. The subsequent law enforcement operation illustrates the increased regulatory scrutiny and international cooperation aimed at dismantling hacker collectives operating ransomware and extortion campaigns.
6 months ago
Kill Chain
2025 Salesforce Data Breach: Supply Chain Extortion Hits Retail Sector
In mid-2025, a coordinated cybercriminal campaign led by UNC6395 and affiliates of Muddled Libra targeted Salesforce tenants via a multi-stage supply chain attack stemming from infiltrated third-party integrations such as Salesloft and Drift. Attackers used advanced social engineering and process exploitation rather than technological vulnerabilities to gain access to Salesforce customer data—including sensitive records like accounts, contacts, and opportunities. The operation highlighted the growing focus on data theft extortion tactics and the use of encrypted communications, with threat actors actively marketing stolen data through Telegram channels under monikers like "Scattered LAPSUS$ Hunters." The impact has been significant for retailers and digital platform users, driving urgent defensive and policy changes at Salesforce and affected enterprises. This incident underscores an accelerating threat shift in 2025: attackers are increasingly leveraging social engineering and the SaaS supply chain to circumvent traditional defenses, monetizing access through extortion rather than ransomware. The event has intensified industry efforts to tighten access controls and enforce encryption, amid persistent regulatory and law enforcement actions.
6 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports