Loading story…
Żabka, Poland’s largest convenience store chain, disclosed a cyberattack after attackers used a compromised account belonging to an external service provider to gain unauthorized access to internal technical systems. The company said it detected and blocked the intrusion late last week, notified Poland’s data protection authority and law enforcement, and reported that payment systems, transaction data, the Żappka loyalty app, and store operations were not affected. Poland’s Minister of Digital Affairs said authorities were informed promptly and that available information indicated customer data and retail operations were not impacted.
The incident surfaced after hackers allegedly offered stolen Żabka data for sale on a cybercrime forum for €5,000 and published sample files online. Reporting on the sample indicated the exposed material may include about 541,000 Jira issues, roughly 229,734 service-desk tickets, and source code from 89 GitLab repositories, along with employee and contractor data, internal documentation, passwords, authentication tokens, and API keys. Review of the sample also pointed to a GitLab access token embedded across repository dumps and other live-looking secrets, including Cloudflare API keys, a MongoDB admin password, and messaging broker credentials, although Żabka has not confirmed the full scope of the allegedly stolen data.
See attribution, scope, and your downstream exposure.
6 events from the most recent confirmed update back to the earliest known activity.
A newly created forum account advertised an alleged Żabka Polska dataset for €5,000, claiming it included about 541,000 Jira issues, 229,734 service-desk tickets, and source code from 89 GitLab repositories. The seller account reportedly had no trading history and posted the listing 14 minutes after creation.
Alimentation Couche-Tard announced a €7.56 billion offer for Żabka Group. One report noted the later leak listing appeared two days after this announcement.
Żabka publicly disclosed a cyberattack affecting internal company systems and said the intrusion came through a compromised third-party account rather than a direct breach of its own infrastructure. The company said it notified Poland’s data protection authority and law enforcement, and Poland’s Minister of Digital Affairs said authorities were informed promptly.
Reporting said the attackers posted sample data online and contacted journalists and companies working with Żabka to publicize the breach before advertising the data for sale. Niebezpiecznik reported the attackers appeared to have accessed Żabka’s Jira environment.
Ransomnews reviewed the sample archive attached to the forum listing and found the headline counts for Jira issues and service-desk tickets largely matched the evidence provided, while some secondary claims did not. The sample reportedly included a GitLab access token reused across 89 repository dumps and live-looking secrets such as Cloudflare API keys, a MongoDB admin password, and messaging broker credentials.
Żabka said attackers gained unauthorized access to internal technical systems through a compromised account belonging to an external service provider or contractor. The company said it detected the intrusion late last week and immediately blocked it, while stating payment systems, transaction data, the Żappka app, and store operations were unaffected.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
4 references tracked. Mallory keeps watching after this page renders.
teiss.co.uk
Open sourcetherecord.media
Open sourcezabka.pl
Open sourcesecurityaffairs.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Inditex disclosed that unauthorized access to databases hosted by a former third-party technology provider exposed data tied to nearly **197,000 Zara customers**. The compromised records reportedly included about **197,400 unique email addresses**, order IDs, product SKUs, geographic market information, purchase history, and customer support ticket data. Inditex said the incident did **not** affect names, passwords, payment details, postal addresses, or phone numbers, and added that Zara’s own operations and internal systems were not impacted. The breach has been linked by **Have I Been Pwned** to the **ShinyHunters** extortion group’s April 2026 “pay or leak” campaign. According to the reporting, the attackers claimed they gained access through compromised **Anodot** authentication tokens and exfiltrated data from **BigQuery** environments, including a broader archive that allegedly contained up to **95 million support ticket records**. After failed extortion attempts, the group reportedly published the stolen data, while Inditex said it activated security protocols and began notifying relevant authorities.
Jun 29, 2026
A threat actor has claimed to have breached enterprise intelligence software provider **InfoDesk** and is offering the allegedly stolen data for sale on a dark web forum. Reporting indicates the sample data included five records from each of 18 organizations, along with InfoDesk records, and the actor claimed to hold as many as 1,000 records in total. The exposed information reportedly consists primarily of employee full names and corporate email addresses tied to major organizations, including firms in the pharmaceutical, healthcare, financial, consulting, and nonprofit sectors; Cybernews specifically said the data involved employees at companies such as **Moderna**, **Johnson & Johnson**, and **Bayer**. Researchers said the immediate danger is not large-scale identity theft but highly targeted phishing and social-engineering attacks. Because the records appear linked to a known enterprise vendor, attackers could use the contact details to craft convincing lures for credential theft, malware delivery, or follow-on business email compromise. The alleged incident adds to broader concerns over third-party supplier exposure, where compromises at service providers can create downstream risk for multiple corporate customers at once.
Jun 29, 2026
Dark web monitoring reports surfaced multiple **alleged data leaks** affecting unrelated organizations, with several listings offering databases for sale or direct download. Reports claim **Republic (republic.com)** user data (~4.94M users) was listed for sale for **$2,400**, allegedly including names, emails, physical addresses, and phone numbers. Separate dark web listings also alleged exposure of **rueducommerce.fr** user data (linked in reporting to **Carrefour**) totaling ~2.17M records with similar PII, as well as alleged leaks involving **Dunzo** (~3.4M records) and **Menulux** (~93K records). Additional reporting highlighted a historical breach dataset for the **YouHack** forum (2013; ~107K users) containing usernames, emails, passwords, IPs, posts, and private messages, and a smaller exposure tied to **buylottoonline.com** (~38.5K email records). One of the most consequential claims involved **Salesfloor / People Powered E-Commerce (salesfloor.net)**, attributed in reporting to **LAPSUS$**, alleging theft of roughly **4 TB uncompressed** (1 TB compressed) data including **source code, logs, and customer information**, with potential downstream impact to retail brands using the platform. Separately from the dark-web-leak theme, other items in the set describe distinct vulnerability-driven risks rather than breach listings: **Zoom Node MMRs** command injection (**CVE-2026-22844**, CVSS 9.9) enabling arbitrary code execution in certain hybrid meeting deployments; **SmarterMail** auth bypass (**CVE-2026-23760**) enabling admin password reset via `force-reset-password` and potential RCE; **Vite** improper access control (**CVE-2025-31125**) enabling sensitive file exposure via query parameters such as `?inline&import` / `?raw&import` (noted as added to CISA KEV); and **Appsmith** password-reset token exposure (**CVE-2026-22794**) enabling account takeover, with internet-exposed instances identified via Shodan and remediation via upgrade to *Appsmith* 1.93. These vulnerability reports are separate from the dark web leak claims and should be tracked as independent patching priorities rather than as part of a single breach event.
Jun 29, 2026