Cyberattacks hit major retailers, exposing customer data and halting operations

A surge of cyberattacks has rattled some of the world’s best-known retailers, compromising customer data and disrupting digital operations in incidents that expose the retail industry’s growing vulnerability to sophisticated hackers.

Outdoor gear brand North Face, luxury jeweller Cartier, and lingerie retailer Victoria’s Secret have all reported data breaches in recent days. These incidents follow a wave of cyber intrusions in the UK, where hackers targeted major brands including Harrods and Marks & Spencer, the Wall Street Journal reported.

Social engineering and stolen passwords at the core

Cybersecurity experts say a hacking group known as Scattered Spider may be behind several of these attacks. The group reportedly uses social engineering, pretending to be employees locked out of their accounts to trick help desks into resetting passwords. This method has been linked to earlier breaches in the U.K., although Scattered Spider has not been officially named in the latest cases involving North Face, Cartier, or Victoria’s Secret.

North Face said it suffered a different kind of attack, known as credential stuffing, where hackers used previously stolen email-password combinations to break into customer accounts. “Based on our investigation, we believe that the attacker previously gained access to your email address and password from another source,” the company said in an email to affected users.

Cartier confirms personal data breach

Cartier informed customers via email that hackers may have stolen their names, email addresses, countries of residence, and birth dates. However, the company emphasized that no passwords, credit card numbers, or banking details had been accessed.

Victoria’s Secret shuts down website for days

Victoria’s Secret took the extraordinary step of shutting down its entire website and corporate systems on May 26, keeping them offline for three days. The company confirmed on Tuesday that the incident did not affect financial results for the latest quarter, but it did delay its planned earnings announcement due to temporary loss of access to necessary data.

The site was restored on May 29, and no detailed explanation has yet been given about how the breach occurred.

Retail sector on high alert

Cybersecurity analysts warn that these breaches are part of a growing trend in which attackers exploit both human error and outdated security systems. Charles Carmakal, chief technology officer at Mandiant, said in a general statement that companies sometimes “have to break certain things to stop the attacker from getting deeper into their network.”

The wave of attacks underscores the fragility of online infrastructure in the face of increasingly bold cybercriminals. With retailers sitting on vast amounts of customer data, the risks of delayed detection and inadequate response are more visible than ever.