Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Retail Industry

Breach intelligence, attack campaigns, and threat reports targeting the Retail Industry sector.

198 threat reports
Page 15 of 17
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Retail Industry Threat Reports

Showing 169–180 / 198 reports
CISA Adds Adobe/Magento & WSUS Exploits to 2025 KEV Catalog
Government Administration10 months ago

CISA Adds Adobe/Magento & WSUS Exploits to 2025 KEV Catalog

In October 2025, CISA added two newly discovered, actively exploited vulnerabilities—CVE-2025-54236 impacting Adobe Commerce and Magento, and CVE-2025-59287 impacting Microsoft Windows Server Update Services—to its Known Exploited Vulnerabilities (KEV) Catalog. Both vulnerabilities are believed to be leveraged by threat actors to gain unauthorized access and facilitate lateral movements within victim networks. Federal Civilian Executive Branch (FCEB) agencies are now required by BOD 22-01 to remediate these specific threats by the mandated due date, minimizing risk to critical government infrastructure and mission-critical digital assets. This inclusion highlights a rising trend of attackers weaponizing public-facing application and misconfigured update service vulnerabilities, reflecting an escalation in both attack sophistication and speed of exploitation. Organizations of all types face mounting regulatory and operational pressure to harden security posture and accelerate remediation response times.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
Morocco’s 'Jingle Thief' Heist Shows Retailers’ Holiday Cyber Weaknesses
Retail Industry10 months ago

Morocco’s 'Jingle Thief' Heist Shows Retailers’ Holiday Cyber Weaknesses

In late 2024, the retail sector was targeted by a Morocco-based cybercriminal operation dubbed 'Jingle Thief.' The attackers orchestrated a large-scale gift card fraud campaign by exploiting weaknesses in payment and e-commerce systems. Through phishing and the abuse of unencrypted and east-west traffic within retail networks, the adversaries accessed internal gift card management tools. The stolen gift card data was quickly monetized, resulting in fraudulent transactions and direct financial losses to multiple retailers during the lucrative holiday season. This incident underscores the urgent need for advanced segmentation, strong encryption of data in transit, and continuous network threat detection in retail environments. It also highlights an emerging trend of financially motivated attackers focusing on high-impact, low-resilience periods such as holiday shopping surges.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
How Chinese Gangs Engineered a $1B+ US Credit Card Fraud Wave via Smishing in 2025
Financial Services10 months ago

How Chinese Gangs Engineered a $1B+ US Credit Card Fraud Wave via Smishing in 2025

In 2025, large-scale social engineering attacks targeted US consumers through smishing campaigns that impersonated legitimate institutions such as highway toll authorities and the US Postal Service. Orchestrated by Chinese criminal organizations, these fraudulent text messages lured victims into divulging their credit card details, which were then monetized to purchase goods via an elaborate scheme. Attackers leveraged the stolen card data by installing it into Google and Apple Wallets in Asia and facilitating cross-border purchases, enabling smooth, large-scale fraud amounting to over $1 billion across a three-year period. This case underscores a recent surge in sophisticated financial fraud campaigns that combine social engineering with digital payment ecosystems, exploiting global tech infrastructure and multi-region collaboration. The landscape sees continued pressure on organizations to safeguard payment and customer data against rapidly evolving threats.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(medium)
IImpact(high)
Read report
Global Smishing Triad Campaign: 194,000 Malicious Domains Power Massive Phishing Surge
Banking/Mortgage10 months ago

Global Smishing Triad Campaign: 194,000 Malicious Domains Power Massive Phishing Surge

In 2024, security researchers attributed a global smishing campaign to a threat group known as the Smishing Triad, which registered more than 194,000 malicious domains since January 1. Utilizing infrastructure predominantly registered through Hong Kong-based providers with Chinese nameservers, the actors orchestrated widespread phishing via SMS attacks targeting banking, logistics, and other sectors. Victims received highly targeted text messages that redirected them to credential-harvesting sites, leading to financial fraud and data compromise. The campaign’s scale and global reach underline the adversaries’ operational sophistication and heavy use of automation. This incident reflects a broader surge in phishing tactics leveraging SMS and vast domain infrastructure, bypassing traditional email security. The growing adoption of QR and mobile-first communication further widens the threat surface, putting regulatory and compliance emphasis on new vectors.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
SessionReaper in the Wild: How a 2025 Adobe Commerce Flaw Fueled E-Commerce Breaches
Retail Industry10 months ago

SessionReaper in the Wild: How a 2025 Adobe Commerce Flaw Fueled E-Commerce Breaches

In early 2025, a critical security vulnerability (CVE-2025-54236) was discovered in Adobe Commerce, formerly known as Magento. This flaw, actively exploited in the wild as 'SessionReaper,' enables remote attackers to hijack user sessions on e-commerce sites, bypassing authentication controls. Attackers leveraged this weakness to compromise sensitive customer data, manipulate transactions, and disrupt online sales operations for affected merchants. The exploitation led to significant financial and reputational risks, prompting rapid incident response and emergency patching. This incident highlights the growing trend of sophisticated web application attacks targeting popular e-commerce platforms. As threat actors increasingly weaponize session hijacking techniques and exploit critical flaws pre-patch, organizations must prioritize timely vulnerability management and layered defenses to protect customer trust and regulatory compliance.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Toys "R" Us Canada Faces Customer Data Leak in 2024 Breach
Retail Industry10 months ago

Toys "R" Us Canada Faces Customer Data Leak in 2024 Breach

In late April 2024, Toys "R" Us Canada disclosed a data breach after threat actors exfiltrated and subsequently leaked customer records from its systems. The breach was confirmed via direct customer notifications, revealing that sensitive customer data—including names and contact details—was stolen and made public on a hacker forum. The company identified the security incident after discovering that attackers had gained unauthorized access and were able to access certain internal systems, leading to the data leak. Following the discovery, Toys "R" Us Canada initiated an investigation and notified the affected individuals, emphasizing that payment information was not compromised. This incident highlights a continued trend of cybercriminals targeting retail and e-commerce sectors for customer data theft and exposure. The breach exemplifies the increasing frequency of attacks leveraging stolen credentials or vulnerable infrastructure, underlining the urgent need for robust data protection and threat monitoring strategies across all consumer-facing organizations.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Over 250 Magento Stores Breached Overnight Through Critical Adobe Commerce Flaw
Retail Industry10 months ago

Over 250 Magento Stores Breached Overnight Through Critical Adobe Commerce Flaw

In October 2025, over 250 Magento and Adobe Commerce online stores were compromised in less than 24 hours after attackers exploited a newly disclosed critical vulnerability, CVE-2025-54236 (CVSS 9.1). The flaw, stemming from improper input validation, allowed threat actors to compromise e-commerce shops directly via their web applications, enabling unauthorized access, data exfiltration, and potential payment card theft. Security researchers observed an automated wave of exploitation attempts soon after public disclosure, underlining how rapidly threat actors weaponize emerging vulnerabilities for financial gain and to cause operational disruption. This incident highlights the urgent need for rapid patch management and layered web application defenses, as attackers increasingly leverage zero-day and recently disclosed vulnerabilities to target widely used commerce platforms, further increasing risks to consumer data and regulatory compliance for online retailers.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
Jingle Thief: How Hackers Exploited Cloud to Steal Millions in Retail Gift Cards (2025)
Retail Industry10 months ago

Jingle Thief: How Hackers Exploited Cloud to Steal Millions in Retail Gift Cards (2025)

In October 2025, a cybercriminal group known as Jingle Thief orchestrated a sophisticated financial fraud campaign targeting retail and consumer services organizations operating in cloud environments. Leveraging phishing and smishing tactics to obtain employee credentials, the attackers gained access to cloud-based systems responsible for managing digital gift card issuance. Once inside, they exploited weak east-west traffic controls and lack of adequate segmentation to move laterally and automate gift card theft at scale, resulting in losses worth millions of dollars and significant operational disruption to affected businesses. This incident highlights an ongoing escalation in targeted cloud infrastructure attacks, especially towards retail functions involving financial assets like digital gift cards. The use of cloud-native attack vectors and credential phishing underscores the urgency for enhanced zero trust practices, robust detection controls, and strict policy enforcement to protect sensitive assets in distributed environments.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Mideast & African Hackers Launch Multi-Vector Attacks on Governments, Banks, and Retailers in 2024
Government Administration10 months ago

Mideast & African Hackers Launch Multi-Vector Attacks on Governments, Banks, and Retailers in 2024

In early 2024, multiple threat groups originating from the Middle East and Africa executed a series of sophisticated, multi-vector cyber campaigns targeting government agencies, banks, and small to midsize retailers across the region. Attackers leveraged a blend of techniques including encrypted traffic evasion, lateral movement, cloud misconfiguration, and remote access tools. These campaigns exploited gaps in east-west security, egress controls, and cloud segmentation, resulting in data exfiltration, service disruptions, and operational downtime across multiple sectors. The tactics exposed critical weaknesses in hybrid cloud architectures, impacting regulatory compliance and eroding trust in public and financial institutions. This incident highlights the escalating trend of advanced regional threat actors targeting not just political or large economic entities, but also smaller businesses, using methods that combine traditional and cloud-native attack vectors. The frequency and sophistication of such attacks underscore the need for adaptive, zero trust security frameworks and heightened vigilance across both public and private sectors.

Medium impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Critical SessionReaper Flaw Exploited in Adobe Magento: 2025 Breach Analysis
Retail Industry10 months ago

Critical SessionReaper Flaw Exploited in Adobe Magento: 2025 Breach Analysis

In June 2025, a critical vulnerability known as SessionReaper (CVE-2025-54236) was exploited by cybercriminals targeting Adobe Magento (Adobe Commerce) platforms. Attackers leveraged the web application flaw to hijack user sessions and gain unauthorized access to sensitive online store environments. Hundreds of exploitation attempts were recorded within days of public disclosure, with threat actors using automated tools to scan, identify, and compromise unpatched Magento installations. The breaches exposed customer data, payment information, and threatened e-commerce operations for businesses relying on the affected platform. This incident stands out due to the speed of threat actor mobilization and highlights a broader trend of mass targeting critical web application bugs in widely used platforms. With compliance frameworks under increased scrutiny and evolving ransomware threats, rapid patch management has become a top priority for e-commerce and cloud-driven organizations.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
Jingle Thief: A 2024 Look at Cloud Gift Card Fraud in Retail
Retail Industry10 months ago

Jingle Thief: A 2024 Look at Cloud Gift Card Fraud in Retail

In early 2024, security researchers uncovered "Jingle Thief," a sophisticated cybercriminal campaign targeting major retail organizations through coordinated phishing and smishing attacks. The attackers leveraged credential harvesting to gain unauthorized, persistent access to enterprise cloud environments and exploited multicloud weaknesses to orchestrate large-scale, automated gift card fraud. This activity resulted in the theft of significant monetary value from targeted retailers and demonstrated the evolving tactics of financially motivated threat groups seeking to exploit cloud infrastructure and weak east-west security controls. Jingle Thief underscores an alarming trend: attackers increasingly exploit cloud misconfigurations and multifactor authentication gaps to maintain post-compromise access for extended periods. The campaign exemplifies the need for enterprises to adopt Zero Trust strategies and rigorous east-west segmentation as criminals shift focus toward cloud-native targets.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Muji Halts Online Sales After Supply Chain Ransomware Hits Logistics Partner
Retail Industry10 months ago

Muji Halts Online Sales After Supply Chain Ransomware Hits Logistics Partner

In June 2024, Japanese retail giant Muji was forced to suspend its online sales after a logistics outage caused by a ransomware attack on Askul, its major delivery partner. The incident was triggered when attackers compromised Askul's systems, encrypting critical operational data and disrupting supply chain operations. As a result, Muji's ability to fulfill customer orders was severely impacted, highlighting the downstream risk associated with third-party vendors in an interconnected retail ecosystem. This breach not only halted Muji's core e-commerce activities but also underscored the vulnerability of global supply chains to cyber extortion. This event is particularly relevant as ransomware groups increasingly leverage supply chain attacks to maximize disruption and extort multiple victims. It reflects a rapid evolution in attacker tactics, where targeting essential providers amplifies business risk, and regulatory scrutiny on supply chain resilience continues to intensify.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(high)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports