Incidents in sector:
Attackers hijacked internet-exposed refrigeration controllers to heat fridges and freezers at hundreds of French supermarkets, spoiling food and triggering fires.
The UK arm of South Africa's Foschini Group disclosed a cyberattack that took several IT systems offline across its Phase Eight, Hobbs and Whistles brands.
Dutch-based retail group Ahold Delhaize took websites, apps and online grocery services offline across its European and US banners after a security incident on its network, while keeping stores open.
Japanese second-hand retailer Bookoff Group disclosed that unauthorized access to a subsidiary's membership system may have leaked the personal data of up to about 6.43 million member records.
Switzerland's Ricardo online marketplace disclosed that a security vulnerability exposed the names, postal addresses and phone numbers of about 890,000 user accounts.
UK online fashion retailer ASOS confirmed that attackers used stolen employee credentials to access customer data via third-party platforms, after shoppers received hacker-controlled push notifications through its app.
A faulty AI-generated mailing script exposed 95,364 Bee Cheng Hiang members' email addresses to one another in Singapore's first AI-related data breach.
Ecommerce platform BigCommerce warned merchants that attackers had compromised credentials for the third-party Ribon and Ribon 1.5 apps, used them to inject malicious scripts into storefronts and accessed shopper names, emails, phone numbers and shipping addresses.
American workwear maker Carhartt was hit by a ShinyHunters extortion campaign that exposed the personal information of 12.9 million customer accounts after the theft of data from its cloud analytics platform.
A threat actor using the handle TheHatman advertised roughly 3.64 million employee directory records scraped from the Microsoft Azure and Entra ID tenants of multiple Fortune 500 companies, with access reportedly gained through stolen credentials harvested by infostealer malware.
A cyberattack on logistics giant CEVA Logistics disrupted eight European warehouses and exposed customer shipment data belonging to downstream clients including Valve's Steam hardware store, Dutch retailer Bol, De Bijenkorf, Ace & Tate and football club Ajax.
Luxury enamel-jewellery maker FREYWILLE disclosed a cyberattack on 6 August 2026 after detecting unauthorised activity, as the Aurora ransomware group claimed to have stolen customer and employee data.
Researchers reported that Cl0p was exploiting CVE-2026-12569 in internet-exposed PTC Windchill and FlexPLM product lifecycle management servers to steal engineering data, sending extortion emails to victims from 20 July 2026.
Foodservice distributor Sysco notified individuals that an unauthorized party obtained files containing personal information after an April 2026 intrusion, following separate extortion claims by the Qilin ransomware gang and by ShinyHunters, which said it stole more than 61 million Salesforce records.
Cosmetics group EstΓ©e Lauder disclosed that attackers exploiting an Oracle E-Business Suite flaw accessed its HR system in August 2025, exposing Social Security numbers, passport and bank details, health data and employment records.
Lease-to-own company Upbound Group disclosed in an SEC filing that customer data obtained in cybersecurity incidents was used to open fraudulent Acima lease agreements, causing about $13 million in losses in the second quarter of 2026.
Lidl notified online-shop customers in Germany, Belgium and the Netherlands that attackers who breached one of its external IT service providers stole a file of personal data including names, contact details and dates of birth, while stressing that payment data, passwords and customer accounts were not affected.
After negotiations stalled, the ShinyHunters extortion crew published data it claimed to have stolen from Baker Distributing's Salesforce and SharePoint systems, exposing more than 100,000 customer email addresses and contact records.
In May 2026, the GTA V and CS2 cheat service Atlas Menu suffered a data breach. An attacker claimed to have gained access to all Atlas systems and published the service's database to a public GitHub repository.
In late May 2026, a B2B commercial database attributed to French organic-food distributor Nature & Cie surfaced on a cybercriminal forum, exposing roughly 5,635 stores, over 1,500 professional contacts and around 1,500 sales-visit reports covering Biocoop, Naturalia and La Vie Claire partners.
The Optic 2000 group, one of the leading networks of opticians in France, appears in a data leak published on a cybercrime forum. The
Camping-Car Plus, a French e-commerce retailer of motorhome and camper-van accessories, notified customers in May 2026 of a data breach exposing names, postal and email addresses, phone numbers and account login credentials including passwords; no banking data was affected.
On 22 May 2026, a database holding the personal records of roughly 5.9 million customers of French optical chain Atol Mon Opticien was put up for sale on a cybercrime forum, exposing names, birthdates, emails, phone numbers and postal addresses.
On 22 May 2026, a database allegedly holding 5,924,215 customer records from the French optician cooperative Atol was put up for sale on a cybercrime forum, exposing names, birth dates, postal addresses, emails and phone numbers.