Target Sector: Retail, E-Commerce & Hospitality
Court filings, technical advisories, and SEC Form 8-K enforcement disclosures documenting cyber intrusions against organizations in Retail, E-Commerce & Hospitality.
Key Facts
- 23 documented prosecution and advisory matters targeting Retail, E-Commerce & Hospitality.
- Cumulative reported financial losses exceed $4.9 billion.
- 12 of 23 cases reached conviction, guilty plea, or final sentencing.
- Tracked actors include FIN7, REvil / Sodinokibi, Scattered Spider / UNC5537, BlackSuit Ransomware Group.
Documented Incidents (23)
U.S. v. Hladyr, Kolpakov & Iarmak (FIN7 Cybercrime Syndicate)
Prosecution of senior leaders of the FIN7 transnational cybercrime syndicate who hacked into thousands of computer systems across the United States, stealing more than 20 million customer credit card records from restaurants and hospitality chains.
U.S. v. Roman Seleznev (Track2 Point-of-Sale Carding)
Prolific cybercriminal (Track2) who hacked into more than 500 small businesses and restaurants across the United States, stealing millions of credit card numbers and generating tens of millions of dollars in illicit sales on automated carding portals.
U.S. v. Yaroslav Vasinskyi (Kaseya VSA / REvil Ransomware)
Ukrainian national and REvil ransomware affiliate responsible for deploying the ransomware attack that hijacked Kaseya VSA management software, instantly encrypting up to 1,500 downstream businesses on July 4th weekend.
U.S. v. Albert Gonzalez (TJX & Heartland Payment Systems)
Mastermind of the largest credit card theft operation in history at the time, hacking TJX Companies, BJ's Wholesale Club, OfficeMax, and Heartland Payment Systems, stealing over 130 million payment cards.
Operation Cookie Monster (Genesis Market Takedown)
Coordinated multinational takedown of Genesis Market, the world's most prominent illicit broker of stolen digital browser fingerprints, cookies, and compromised account credentials.
U.S. v. Marcus Hutchins (Kronos Banking Malware)
British malware researcher who previously halted the global WannaCry ransomware outbreak charged with authoring the Kronos banking trojan and UPAS kit years earlier as a teenager.
U.S. v. Peter Levashov (Kelihos Botnet)
Russian operator (Severa) of the notorious Kelihos botnet, controlling over 100,000 infected computers worldwide used to harvest credentials, distribute ransomware, and blast billions of spam and stock pump-and-dump emails daily.
U.S. v. Aleksandr Brovko (Botnet Parsing & Credential Sales)
Russian national who developed automated scripts to parse botnet logs, extracting financial information and account credentials from thousands of victim computers and marketing them on cybercrime forums.
U.S. v. Kirill Victorovich Firsov (Deer.io Dark Web Shop)
Russian administrator of Deer.io, a decentralized cyber storefront platform hosting over 24,000 active automated shops selling hacked accounts, corporate credentials, and identity documents.
U.S. v. Sergey Medvedev et al. (Infraud Organization)
Global cybercrime enterprise operating under the slogan 'In Fraud We Trust' with over 10,000 members, trafficking in stolen identities, counterfeit documents, compromised credit cards, and banking trojans.
U.S. v. Brett Johnson (ShadowCrew Cybercrime Syndicate)
Pioneering cybercriminal known as 'The Original Internet Godfather' who built and operated ShadowCrew, the prototypical dark web marketplace for trafficking in stolen identities and credit card data.
U.S. v. Max Ray Vision (Iceman / CardersMarket)
Former white-hat computer security analyst turned master cybercriminal who operated CardersMarket, hacking rival criminal forums to steal their user databases and monopolize illicit credit card trafficking.
U.S. v. Ross Ulbricht (Dread Pirate Roberts / Silk Road)
Historic trial and life sentencing of Ross William Ulbricht, creator and operator of Silk Road, the internet's first comprehensive darknet market using Tor and Bitcoin.
Target Corporation Point-of-Sale Data Breach (Fazio Mechanical Ingress)
Landmark retail cyberattack where attackers penetrated Target internal corporate networks using stolen billing portal credentials from a third-party refrigeration and HVAC vendor, subsequently deploying BlackPOS memory scraping malware to steal 40 million credit card numbers and 70 million customer records.
MGM Resorts Cyberattack (Scattered Spider / ALPHV Vishing Ingress)
Sophisticated social engineering and ransomware attack carried out by cybercrime collective Scattered Spider partnering with ALPHV/BlackCat, utilizing a 10-minute phone call to the Okta IT helpdesk to bypass MFA, hijack administrative privileges, and paralyze hotel reservations, digital keys, and casino slot machines.
Snowflake Enterprise Credential Stuffing & Customer Cloud Thefts
Financially motivated threat actor collective UNC5537 systematically infiltrated over 165 corporate customer tenants hosted on Snowflake (including Ticketmaster, Santander Bank, Advance Auto Parts, and LendingTree). Attackers leveraged infostealer malware logs dating back years against enterprise user accounts that lacked multi-factor authentication and IP network allowlists, exfiltrating billions of consumer records.
CDK Global BlackSuit Ransomware Incident
Destructive ransomware incident that incapacitated CDK Global, the premier SaaS dealer management platform for approximately 15,000 car dealerships across North America. Attackers deployed BlackSuit ransomware throughout CDK cloud and on-premises data centers, forcing dealership employees into pen-and-paper workarounds for weeks until an estimated $25 million ransom was transferred.
Marriott Starwood 383 Million Guest Reservation Breach
State-sponsored cyber espionage operators maintained undetected access to the Starwood guest reservation database for four years, deploying remote access trojans and memory scrapers to exfiltrate unencrypted passport numbers, payment cards, and travel itineraries.
Caesars Entertainment Scattered Spider Extortion ($15M Ransom)
Sophisticated vishing and social engineering intrusion by the Scattered Spider syndicate targeting an outsourced IT helpdesk servicing Caesars Entertainment, culminating in loyalty database exfiltration and approximately $15 million in cryptocurrency extortion paid to avert public release, disclosed in SEC Form 8-K Item 1.05.
Neiman Marcus 1.1 Million Payment Card In-Memory Scraping
Sophisticated memory-scraping malware intrusion into point-of-sale systems across 77 Neiman Marcus luxury department stores, capturing payment card Track 2 data in memory over a four-month stealth campaign, resolved through a multi-state Attorney General consent decree.
Home Depot 56 Million Payment Card Breach (BlackPOS Malware)
Historic retail network compromise wherein cybercriminals used stolen third-party HVAC vendor credentials to penetrate Home Depot corporate intranet, deploying custom BlackPOS memory-scraping malware across 2,200 store checkout terminals and exfiltrating 56 million credit and debit card records.
FTC v. Drizly, LLC & CEO James Cory Rellas (Personal Liability Consent Order)
Landmark Federal Trade Commission administrative enforcement action where the FTC held alcohol delivery marketplace Drizly and its CEO individually accountable for lax cybersecurity practices that exposed 2.5 million consumer records, requiring the CEO personally to implement comprehensive security programs at any company he leads for ten years.
U.S. v. FIN8 Conspirators (Badhatch Hospitality POS Malware)
Federal criminal indictment and investigative findings documenting financially motivated threat syndicate FIN8, which deployed Badhatch and Sardonic backdoors into point-of-sale memory across nationwide hotel and restaurant chains, scraping hundreds of thousands of customer payment cards.