Baydöner
May 21, 2022
•[ hack, malware, retail ]
Turkish kebab chain Baydner was breached on May 21, 2022: malware on its IT manager's computer exposed web-service passwords, and attackers copied data on 505,337 people, then messaged an executive. Turkey's KVKK fined the chain 1M TL in 2026.
Hot Topic
October 21, 2024
•[ leak, retail, technology ]
An alleged data breach exposes the personal information of 56,904,909 accounts for Hot Topic, Box Lunch, and Torrid customers, but the threat actors claims to have stolen 350 million records.
AIL Hospitality Group
March 7, 2025
•[ ransomware, leak, retail ]
PEAR listed AIL Hospitality Group on its leak site on August 5, 2025. DataBreach.com later indexed 11,086 records containing names and driver's license information and assigns March 7, 2025 as the breach date. Independent ransomware trackers estimate the compromise in early July 2025, so the precise intrusion date remains contested. No independently verified operational disruption has been established.
The North Face
April 23, 2025
•[ hack, brute-force, retail ]
Attackers used previously leaked credentials in a large-scale credential-stuffing campaign against The North Faces online customer accounts in April 2025. Unauthorized logins exposed personally identifiable information from 2,861 customer profiles, though no financial data was accessed.
YES24
June 9, 2025
•[ ransomware, retail, technology ]
Ransomware encrypted internal servers at YES24 beginning June 9 2025, forcing nationwide outage of its ticketing, e-book, and online community services for four days; operations gradually restored; no confirmed data exfiltration.
Under Armour
November 17, 2025
•[ ransomware, retail, technology ]
Everest ransomware group claims to have breached Under Armour systems and exfiltrated 343GB of data including detailed product records internal corporate files and extensive customer information and has issued a short deadline for the company to make contact while threatening to leak the data if there is no response
iFood
December 1, 2025
•[ leak, technology, retail ]
iFood confirmed unauthorized access arising from an incident in December 2025. Its initial disclosure estimated approximately 1.2 million affected users, but a later official update increased the confirmed total to approximately 1.5 million individuals. Exposed information included names, telephone numbers, addresses, and CPF taxpayer identification numbers. iFood stated that passwords, bank information, and credit-card data were not compromised. A separate forum claim involving 43.8 million records was not substantiated by iFood and is not combined with this incident. Because only the month was reported, 2025-12-01 is used as the normalized event date.
Grubhub
January 15, 2026
•[ hack, technology, retail ]
Grubhub confirmed that unauthorized actors accessed parts of its internal systems and downloaded data, and sources reported the company faced extortion demands. Reporting linked the incident to a broader Salesforce-related campaign associated with ShinyHunters, including threats to leak data connected to Salesforce and Zendesk tooling used for customer support. Grubhub stated that sensitive information such as customer financial details and order history were not affected, but it did not publicly specify exactly which data fields were taken, how many individuals were impacted, or the precise intrusion window, while it worked with external security experts and law enforcement.
CAMILLA Australia Pty Ltd
April 1, 2026
•[ leak, retail ]
In April 2026, an unauthorized third party accessed CAMILLA Australia Pty Ltd's Australian network and exfiltrated customer records held within its point-of-sale system. CAMILLA secured its systems, notified affected customers and the Australian privacy regulator, and said its operations and order processing continued without disruption.
Karl Chevrolet, Inc. (d/b/a Karl Auto Group)
April 3, 2026
•[ ransomware, leak, retail ]
An unauthorized third party gained access to certain Karl Auto Group computer systems before 2026-03-27. RansomHouse later claimed that it encrypted Karl Chevrolet systems on 2026-04-03, but Karl Auto Group did not publicly confirm the attribution or ransomware deployment. The company discovered the incident on 2026-04-04, when employees encountered unavailable phones and computers. Phone service remained disrupted or intermittent through at least 2026-04-08, although dealerships remained open and directed customers to email, online messages, or in-person service. Karl Auto Group stated that files containing personal information belonging to current and former customers, employees, and other individuals may have been accessed; thousands of customers were notified, but the total number affected was not disclosed. The company reported no evidence of misuse and said it did not pay a ransom.
See's Candies, Inc.
April 11, 2026
•[ ransomware, leak, retail ]
An unauthorized actor accessed portions of See's Candies' network from April 11 through April 13, 2026. See's discovered the activity on April 12 and determined that the actor acquired files before encrypting files on a subset of servers; at least some stolen files were later published on the dark web. Qilin publicly claimed the company. Subsequent regulatory filings report 23,737 affected individuals, while DataBreach.com separately indexed 112,767 rows.
Carnival Corporation
April 14, 2026
•[ social, hack, leak ]
Carnival Corporation reported that an attacker used social engineering on April 14, 2026 to gain access to a limited portion of company IT systems and copy personal information. ShinyHunters claimed responsibility and later published Carnival data after failed negotiations. Carnival reported 5,995,277 affected individuals to the Maine Attorney General, while HIBP reported 8.7 million records and 7.5 million unique email addresses. Public reporting did not confirm encryption, data destruction, or operational disruption.
Baker Distributing Company LLC
May 23, 2026
•[ leak, technology, retail ]
ShinyHunters claimed on May 23, 2026 that it accessed Baker Distributing's Salesforce and SharePoint environments and stole customer, employee, lead, and support-ticket data. The data was subsequently published and indexed, but Baker Distributing did not publicly confirm the actor's full claimed scope. No encryption or operational disruption was documented.
Plexsupply Inc.
May 26, 2026
•[ leak, retail ]
DataBreach.com indexed 936,468 rows associated with Plexsupply and dated the breach to May 26, 2026. PEAR listed the company on its leak site on May 30. Public reporting did not identify the access vector or document encryption or operational disruption.
Sinomax USA
May 28, 2026
•[ ransomware, manufacturing, retail ]
Qilin listed Sinomax USA on May 28, 2026 and threatened to release confidential data unless the company negotiated. DataBreach.com subsequently indexed 96,279 rows associated with the company. Public reporting did not confirm encryption, system unavailability, or operational disruption; therefore, only the achieved data-theft effect is coded.
C2M LLC d/b/a Click2Mail
June 2, 2026
•[ financial, leak, technology ]
A Click2Mail customer reported that the company's online debit-card checkout process was hijacked on June 2 and again later in the summer, with payment-card information captured during checkout and subsequently associated with fraudulent use. Other customers also publicly reported card fraud following Click2Mail transactions. C2M LLC later filed a breach notice with the Vermont Attorney General on September 15 confirming exposure of financial account codes and credit and debit account information affecting at least seven Vermont residents. The regulatory filing confirms the data exposure but does not disclose the technical intrusion method, full compromise window, total victim count, or responsible actor.
Madison Square Garden Sports Corp.
June 5, 2026
•[ social, hack, technology ]
ShinyHunters stated that it breached Madison Square Garden on 2026-06-05 by vishing a low-level employee and abusing Microsoft Entra password-reset access, after which it reached cloud applications including Salesforce. The group demanded payment and published approximately 45 GB of data on 2026-06-16. It claimed more than 26 million customer and corporate records, while later analysis identified 9,782,361 unique email addresses and 2,820,221 unique telephone numbers. Reviewed files included internal talent and risk-assessment records, customer correspondence, and employee material. Reviewed reporting did not confirm that facial-recognition images or payment data were included.
United Auto Supply
June 5, 2026
•[ ransomware, leak, retail ]
WorldLeaks publicly listed United Auto Supply on June 5, 2026 as part of its data-theft extortion operation. Independent ransomware monitoring captured the same June 5 claim, and DataBreach.com subsequently indexed 826,018 records containing personal, contact, and vehicle information associated with the company. United Auto Supply has not publicly confirmed the incident, and no operational disruption has been independently established.
Centra Sota Cooperative
June 10, 2026
•[ leak, retail, energy ]
WorldLeaks claimed Centra Sota Cooperative on June 10, 2026. DataBreach.com subsequently indexed 93,417 records containing personal and contact information. Centra Sota is a member-owned agricultural cooperative headquartered in Buffalo, Minnesota, with grain, feed, agronomy, energy, retail and related operations. No independently verified operational disruption has been established.
Kee Wah Bakery Limited
June 12, 2026
•[ ransomware, retail, technology ]
Kee Wah Bakery discovered on June 12, 2026 that its internal network was not operating normally and subsequently received a ransom note. Its preliminary investigation confirmed a ransomware attack. The company continued operating its physical stores and stated that payment and credit-card information were not affected. Systems containing information concerning employees, business partners, online customers, and loyalty-program members may have been exposed, but Kee Wah had not confirmed data exfiltration or disclosed the number of affected individuals.
