Loading story…
Retailers are facing sustained cyber pressure as attackers target high-value customer and payment data, and consumer trust is increasingly sensitive to breach history and perceived security posture. A SOTI survey cited by Dark Reading found 88% of consumers “think twice” before shopping with a retailer that has experienced a cyberattack, and 22% would avoid a retailer altogether after a breach; others report changing behavior by avoiding a merchant’s website/social channels or withholding personal information. The article notes ransomware activity has been particularly active against UK retailers and points to ongoing global risk to customer data, with Nike mentioned as a potential recent victim.
Separately, ransomware operators are escalating coercion beyond data theft and encryption into more aggressive extortion, including threats of physical harm to executives, according to Semperis research cited in Dark Reading. The same commentary highlights that while Chainalysis estimated ransomware payments fell to $814M in 2024 (down 35% from 2023), groups are adapting by intensifying pressure on victims who are more likely to pay; it recommends resilience-focused controls such as rapid patching, user education, and multi-factor authentication. A TechTarget statistics roundup provides broader context on rising cyber risk (e.g., growth in disclosed vulnerabilities and supply-chain attack impact projections) but does not report on the same specific retail-consumer trust dynamic or the “violent ransomware” trend as a discrete event.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
Semperis research reported that executive physical-harm threats appeared in roughly two-fifths of ransomware incidents it studied, reflecting an escalation in coercive tactics beyond data encryption and theft.
A SOTI report found that 88% of consumers think twice before shopping at a retailer that has suffered a cyberattack, and 22% would avoid that retailer altogether after a breach.
The article cites Nike as a possible recent victim in the retail sector, indicating continued targeting of major consumer brands.
The retail-focused reporting says ransomware attacks increased against UK retailers last year, underscoring the sector's growing exposure to extortion campaigns.
Chainalysis estimated that ransomware payments dropped to $814 million in 2024, a 35% decline from 2023. The reporting suggests attackers increasingly concentrated on victims still willing to pay.
Chainalysis estimated that ransomware payments totaled about $1.3 billion in 2023, establishing a high-water mark used for later year-over-year comparisons.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Reporting and research indicate **ransomware/data-extortion activity remained elevated through 2025 into early 2026**, with threat actors increasingly emphasizing **data theft, public pressure, and supply-chain leverage** rather than encryption alone. Cyble’s threat landscape findings cited by TechRepublic put 2025 at **6,604 recorded ransomware attacks** (up **52% YoY**), with **731 attacks in December** and **2,000+ claims in the last three months of 2025**; the same reporting also notes **supply-chain attacks nearly doubled**, increasing the potential blast radius when service providers are hit. A major example is *Conduent*, where the **January 2025 ransomware attack** is now assessed to have impacted **~25 million Americans** (up from an initial **10 million**), with reporting describing **~8TB of data** stolen including **Social Security numbers and medical data**, alongside days of operational disruption. Separately, Accenture-linked research reported that the **World Leaks** extortion operation added a custom Rust-based tool, **`RustyRocket`**, described as a stealthy **data-exfiltration and proxy** capability using obfuscated, multi-layer encrypted tunnels and a runtime “guardrail” requiring a pre-encrypted configuration—features intended to make detection and monitoring difficult. Broader ecosystem reporting also highlights how **data leak sites (DLSs)** and “naming-and-shaming” tactics have become central to double-extortion pressure, while a weekly incident roundup underscores continued real-world disruption from ransomware (e.g., impacts to public services) and ongoing regulatory consequences for inadequate security controls following breaches.
Jun 29, 2026
Ransomware activity surged in 2025 despite significant law enforcement actions against major ransomware-as-a-service (RaaS) groups, with new groups quickly filling the void and victim numbers reaching record highs. Data from RansomLook.io and Ransomware.live showed a sharp increase in claimed ransomware victims, with global numbers rising from approximately 5,400 in 2023 to over 8,000 in 2025. Attackers increasingly relied on social engineering rather than technical exploits, and the impact of ransomware was felt across all sectors, including retail, education, government, and healthcare. Notable incidents included coordinated campaigns against major UK retailers and disruptive attacks on organizations such as Coupang, University of Phoenix, and the NHS’s technology provider DXC Technology. The year’s most significant attacks demonstrated the systemic and cross-sector nature of modern cyber risk, with attackers exploiting third-party dependencies and identity weaknesses to maximize disruption. High-profile breaches led to operational outages, data exposure, and substantial financial and reputational damage, as seen in the case of Marks & Spencer, which suffered a dramatic drop in profits following a ransomware campaign attributed to the Scattered Spider group. These incidents have prompted organizations to reassess their incident response strategies, invest in ransomware readiness, and strengthen supply chain security as they prepare for evolving threats in 2026.
Jun 29, 2026
Recent reporting highlights a shift in enterprise cyber risk toward **external dependencies and identity abuse**. Coverage of the EU’s **NIS2** directive emphasizes that organizations are expected to treat **supply-chain security** as a core governance and architecture issue, reflecting the reality that third parties (e.g., cloud providers, software suppliers, maintenance access, and outsourced services) are frequent intrusion paths rather than risks contained “inside the firewall.” Separately, findings cited from Eye Security’s *State of Incident Response Report 2026* indicate attackers are increasingly **exploiting existing access** rather than “hacking in,” with **identity-based attacks** dominating and **passwords** implicated in the vast majority of such incidents; common initial compromise paths still include phishing, exposed/misconfigured internet-facing systems, social engineering, and software supply-chain attacks. In healthcare, a Trellix threat intelligence report based on **54.7 million detections** from 2025 healthcare environments warns cyber incidents are escalating from IT disruption into a **patient safety** issue due to highly interconnected systems and “cascading” outages. The report identifies **email** as the leading threat vector and the **U.S.** as the primary target, and describes ransomware and extortion activity intensifying, including groups such as **Qilin** (noted for targeting EHR databases), **INC Ransom**, and newer actors like **Sinobi** focusing on biotech; it also reports a sharp rise in **extortion-only** tactics with per-patient ransom demands intended to sidestep corporate insurance dynamics. Across these sources, **phishing** remains a dominant initial access method, with lures increasingly tailored to privileged IT roles (e.g., “AI Transformation” themes).
Jul 12, 2026