99 Cents Only
August 1, 2025
•[ ransomware, retail ]
INC Ransom claims to have breached Dollar Tree
Pandora (jewelry retailer)
July 20, 2025
•[ leak, retail ]
Pandora confirmed that a third-party vendor holding marketing/customer data was compromised, exposing PII of around 30,000 individuals; no passwords, financial, or payment data stolen.
Chanel
July 25, 2025
•[ social, retail ]
Threat actors accessed Chanels Salesforce-hosted database at a third-party provider via social-engineering/OAuth tactics; data theft detected July 25, 2025; U.S. customer contact details exposed; no operational disruption reported.
Rivers Casino Philadelphia
October 14, 2024
•[ ransomware, malware, retail ]
Rivers Casino Philadelphia disclosed that between Oct 1422, 2024, an unauthorized actor accessed and exfiltrated patron data, including names, SSNs, bank account details, and drivers license numbers. Notifications were issued Dec 30, 2024, with public filings Feb 16, 2025. The ransomware group Cicada3301 claimed responsibility, stating it stole 2.56 TB of data. Rivers Casino offered identity protection services to affected patrons.
Jan Nygaard AS, a major BMW & MINI dealership in Denmark
January 25, 2025
•[ ransomware, hack, malware ]
Den store BMW- og Mini-forhandler Jan Nygaard, der omstter for mere end to milliarder kroner, advarer efter Computerworlds afslring tirsdag morgen sine kunder om, at deres data kan vre blevet stjlet af ransomware-gruppe under hackerangreb for mere end tre uger siden.
PANDORA
January 1, 2025
•[ hack, retail ]
hacked third party service
Conad
January 27, 2025
•[ ransomware, malware, retail ]
Conad, an important wholesale chain in Italy, is hit with a Lynx ransomware attack.
Avery Products Corporation
January 13, 2025
•[ financial, hack, retail ]
Avery Products Corporation warns it suffered a data breach after its website was hacked to steal customers' credit cards and personal information.
Green Bay Packers (Online Store)
January 6, 2025
•[ financial, hack, malware ]
The Green Bay Packers American football team notifies fans that a threat actor hacked its official online retail store in October and injected a card skimmer script to steal customers' personal and payment information.
STIIIZY
January 1, 2025
•[ ransomware, retail ]
Popular cannabis brand STIIIZY discloses a data breach after threat actors breached its point-of-sale (POS) vendor to steal customer information, including government IDs and purchase information. The Everest. ransomware group claims responsibility for the attack.
Robinsons Malls
June 1, 2024
•[ hack, retail ]
In June 2024, the Philippines' largest shopping-mall operators Robinsons Malls suffered a data breach stemming from their mobile app. The incident exposed 195k unique email addresses along with names, phone numbers, dates of birth, genders and the user's city and province.
Bodybuilding
April 22, 2019
•[ leak, phishing, retail ]
{"richText":[{"text":"Bodybuilding.com"},{"font":{"size":10,"color":{"argb":"FF000000"},"name":"Helvetica Neue","scheme":"minor"},"text":" notifies its customers of a security breach detected during February 2019 which was the direct result of a phishing email received back in July 2018. Potentially 18M users are impacted."}]}
Disk Union
June 24, 2022
•[ leak, misconfiguration, retail ]
In June 2022, the Japanese record chain store Disk Union suffered a data breach. The incident exposed 690k unique email addresses along with names, post codes, phone numbers and plain text passwords.
Diskunion
January 1, 2022
•[ hack, retail ]
hacked
