Loading story…
Seiko USA removed an extortion message after attackers defaced part of its website, reportedly in the Press Lounge section, and claimed they had breached the company’s Shopify backend and stolen customer data. The message alleged the theft of names, email addresses, phone numbers, order history, shipping information, and account details, and threatened to publish the data unless the company negotiated within 72 hours using a contact email allegedly planted in a Shopify customer account.
Independent confirmation of the claimed data theft has not emerged, and Seiko USA had not publicly confirmed a breach at the time of reporting. Coverage from multiple outlets established that the defacement and ransom demand occurred, but the identity of the threat actor and the validity of the exfiltration claims remain unverified.
See attribution, scope, and your downstream exposure.
6 events from the most recent confirmed update back to the earliest known activity.
Adaptavist warned customers that an unknown third party was sending misleading messages while impersonating the company following the incident. The activity suggested possible follow-on phishing tied to the breach.
A ransomware group calling itself The Gentlemen claimed responsibility for the Adaptavist incident on its leak site, alleging theft of customer records, source code, credentials, internal documents, and access to production systems. Adaptavist disputed those claims and said it had no evidence supporting such a broad compromise.
By the time of reporting, Seiko USA had removed the extortion message from its website. The company had not publicly confirmed the alleged breach or responded to media inquiries, and the attackers' data-theft claims remained unverified.
Over the weekend before April 20, attackers defaced Seiko USA's website, placing an extortion message in the Press Lounge section. The message claimed the attackers had breached Seiko USA's Shopify backend and stolen customer database information, threatening to publish it within 72 hours unless the company negotiated.
Adaptavist published a notice about the March 2026 security incident, stating its current assessment found access to systems containing typical business data such as contact information, contracts, and NDAs. It said there was no evidence at that time that customer or partner personal data had been exfiltrated or that client or production systems were affected.
The Adaptavist Group said it discovered a security incident in late March 2026 in which an attacker used stolen credentials to gain unauthorized access to some of its systems. The company began investigating the incident with external security specialists.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
5 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcego.theregister.com
Open sourceteiss.co.uk
Open sourcebleepingcomputer.com
Open sourcetheadaptavistgroup.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Checkout.com, a payment services provider, was targeted by the ShinyHunters criminal group, who gained unauthorized access to a legacy third-party cloud file storage system used for internal documents and merchant onboarding materials from 2020 and earlier. The attackers demanded a ransom, but Checkout.com refused to pay, instead donating the equivalent amount to cybercrime research. The company confirmed that its live payment processing platform was not affected, and no merchant funds or card numbers were accessed. Checkout.com has taken full responsibility for the incident, apologized to affected partners, and is working with law enforcement and regulators while notifying impacted parties. The breach affected less than 25% of Checkout.com's current merchant base, as the compromised system contained only historical operational data. The company emphasized its commitment to transparency and accountability, outlining plans to invest further in cybersecurity. The incident highlights the ongoing threat posed by ransomware and extortion groups, with ShinyHunters continuing to target organizations for data theft and ransom. Checkout.com's public stance against paying the ransom and redirecting funds to cybercrime research sets a notable precedent in the industry.
Jun 29, 2026
Threat actor **ShadowByt3s**, using the alias **BlackVortex1**, claimed to have breached Starbucks by accessing a misconfigured Amazon S3 bucket allegedly named `sbux-assets` and exfiltrating about **10 GB** of proprietary data. The actor said the haul includes source code, internal web-based management and inventory tools, developer backup files, authentication logic, internal service URLs, and firmware tied to store equipment including **Mastrena II espresso machines**, **FreshBlends smoothie stations**, beverage dispensers, and **Siren System** and **Blue Sparq** controllers. The stolen material was advertised on dark web forums with claims that proof had been shared through Mega.nz and Telegram, and the actor set an **April 5** extortion deadline, threatening to publish the dataset if Starbucks does not pay. Reporting said the exposure could create supply-chain and operational technology risks because the alleged leak includes control logic and firmware for beverage equipment, while threat intelligence monitoring channels including **VECERT** flagged the claim; the incident also follows a separate Starbucks disclosure in March involving a phishing campaign that compromised **889 Partner Central employee accounts**.
Jun 29, 2026
Trezor disclosed that unauthorized access at third-party logistics provider **ShipMonk** exposed customer order data for **13,689** hardware wallet buyers, affecting recent deliveries across the **U.S., U.K., Sweden, Colombia, Brazil, Italy, and Portugal**. The exposed information included full names, email addresses, phone numbers, and shipping addresses for **11,742** customers, while **1,947** others had more limited data exposed, such as name, city, and email address. Trezor said ShipMonk notified it of the incident after attackers accessed systems containing order records tied to shipments delivered between **May 10 and Aug. 8, 2026**. Trezor said its own infrastructure, wallets, devices, and firmware were **not compromised**, but warned affected customers to expect phishing, impersonation, and possible physical-security risks because the leaked data links identities to hardware wallet purchases. The company said its **90-day data retention policy** limited the scope because older records had already been deleted or anonymized, and it has notified impacted users by email while working with ShipMonk as the provider secures and hardens affected systems. Trezor also said it plans to roll out an **Anonymous Delivery** option, first in the EU and later in the U.S., to reduce future customer exposure.
Sep 4, 2026