Top news stories this week
- Dressed to distress. Fashion retailers face cyber concerns.
- Don't rock the boat. n0n ransomware group threatens maritime sector.
- From untouchable to indictable. Cybercrime crackdown targets threat actors and their enablers.
- Supermarket sweep. Ahold Delhaize suffers second major cyber security incident in two years.
- Crypto crime. Robbery potentially linked to Revolut data breach.
- Patch work. Multiple organisations announce patches to their systems.
1. Fashion retailers face fresh cyber concerns
TFG London, the owner of fashion brands including Phase Eight, Hobbs and Whistles, has confirmed it is responding to a cyber attack affecting parts of its business. Separately, H&M Group is investigating claims that it was targeted by the cybercriminal group ShinyHunters, although the company says it has found no evidence that attackers compromised its environment. These incidents are the latest in a series of cyber events affecting the retail and fashion sector.
So what?
Threat actors target the retail sector due to its large customer bases, extensive third-party relationships and high volumes of personal data. Not every claim of an attack leads to a confirmed breach, but even early claims can disrupt operations, damage reputation, and worry customers.
[Researcher: Gabriella Nolan]
2. n0n ransomware group threatens maritime sector
n0n Group, a ransomware extortion group, has named 38 companies across the maritime, port, and logistics sector that it claims to have breached. The published list includes organisations in 18 countries, with reported ransom demands ranging from USD 2.4 million to USD 14 million. None of the named organisations have publicly confirmed a breach.
So what?
Although the claims remain unverified, the naming of organisations may indicate an effort to pressure victims into payment and could signal ongoing extortion activity within the maritime sector.
[Researcher: Tlhalefo Dikolomela]
3. Cybercrime crackdown targets threat actors and their enablers
The FBI has arrested a prominent ransomware negotiator over alleged links to the infamous threat actor group ShinyHunters.
Separately, the Department of Justice raided multiple laptop farms purportedly being used by North Korean nationals. Law enforcement agencies worldwide also coordinated to take down a criminal ecosystem that enabled malicious messaging targeting 75,000 organisations across 150 countries.
Additionally, the founder of a dark web marketplace was sentenced to 40 years for helping operate a platform that processed over USD 430 million in illegal transactions.
So what?
Coordinated law enforcement action is increasingly disrupting the cyber criminal ecosystem, but organisations should remain vigilant as threat actors will likely adapt and shift tactics rather than capitulate.
[Researcher: Lester Lim]
4. Ahold Delhaize suffers second major cyber security incident in two years
A cyber incident at Dutch retail and e-commerce group Ahold Delhaize forced it to take systems offline. Supermarket websites and apps were disrupted across multiple brands and countries. The incident comes two years after an INC Ransom attack on the company's US systems, in which attackers stole the personal, financial and health information of 2.2 million people.
SO WHAT?
The incident highlights how disruption to shared systems can affect multiple brands and markets simultaneously. Organisations should ensure resilience and incident response plans account for dependencies across the entire corporate group.
[Researcher: Robin Toulalan Parr]
5. Robbery potentially linked to Revolut data breach
A UK-based cryptocurrency investor reported being held at knifepoint during a home robbery, where attackers stole approximately USD 800,000 and other valuables. The victim was reportedly a Revolut customer, which has raised industry concerns that the attackers used personal information exposed in the company’s recent data breach to target them. The incident comes amid reports of cybercriminals increasingly using personal information and threats of physical harm to intimidate victims.
So What?
Data breaches can create risks beyond online fraud, particularly when exposed information could identify an individual's wealth or location. Individuals whose sensitive personal and financial information has been compromised should remain alert to both online and physical security risks.
[Researcher: Asya Sonnichsen]
6. Multiple organisations announce patches to their systems
Ivanti disclosed a zero-day vulnerability in the Ivanti Connect Secure (ICS) remote access gateway and Cisco warned of a critical flaw in its Secure Email Gateway (SEG). Both enable remote code execution and are being actively exploited by threat actors.
Separately, Microsoft released fixes to 1,411 vulnerabilities and two publicly disclosed zero-day flaws in its latest Patch Tuesday, while SAP announced patches to 20 security flaws, including a maximum severity vulnerability in its SAP Python SDK toolkit.
Additionally, GitLab urged to patch a maximum-severity vulnerability in the CI/CD Regular Expression Compiler and Docker warned of a critical vulnerability in Docker Hub. Both affect authentication and access controls.
SO WHAT?
Ensure that systems are patched as soon as a fix is available, prioritising perimeter systems and vulnerabilities that are being actively exploited by attackers.
[Researcher: Milda Petraityte]
