Retail & Consumer — Cyber Threat Activity

Retail and consumer businesses are attacked at the moment they can least afford it, and the sector shows the sharpest recent acceleration in our log: more than 600 recorded incidents, but over 330 of them in the trailing 180 days and 187 in the last 90. 71 groups have been attributed at least one claim, led by Qilin (85), Cl0p (73), Akira (56), SafePay (34) and The Gentlemen (34). Two distinct threats sit behind that number. The first is ordinary extortion timed against trading peaks, when an outage costs revenue by the hour and stock cannot be moved. The second is social engineering aimed at people rather than software. The UK's National Cyber Security Centre issued direct guidance to retailers after a run of 2025 incidents, singling out help-desk password reset procedures as the weak point, and CISA's advisory on Scattered Spider documents the method in detail: impersonate an employee using stolen personal data, talk a help desk into resetting credentials and multi-factor enrolment, then move through single sign-on into cloud data stores. That path requires no malware and defeats most technical controls, because every step is a legitimate action performed by a convincing caller. Retailers are attractive to it because they run large, high-turnover, distributed workforces where an unfamiliar voice is unremarkable. Recorded geography is United States-led at 320 claims, then Canada, Germany, the United Kingdom, Australia and Italy. These figures are extortion-site claims rather than confirmed breaches, and the sector's card-fraud and e-skimming exposure is largely absent from them, so treat the count as a floor on the sector's real incident rate.

All sectors

Recent incidents

Threat actors targeting Retail & Consumer

Where these victims are

Malware used against Retail & Consumer

Families used by the threat actors that target this sector, derived from actor tooling rather than observed in these incidents directly.

Coverage. 92.8% of incidents in our log carry a sector classification; the remainder name a victim we have not placed in an industry. Counts here are a floor, not a total, and are not comparable between sectors of different sizes.

Read the full analysis on IntelFusions