US retailer Kmart has become the latest business to face disruption as a result of a ransomware (opens in new tab) attack. According to reports, the attack encrypted a number of servers operating on the Transformco network owned by Transform Holdco, which acquired Sears and Kmart back in 2019 (opens in new tab).
Bleeping Computer (opens in new tab) reports that the attack has been traced to the Egregor ransomware operation, which has also targeted a number of other organizations, including Barnes and Noble, Ubisoft, and Crytek.
Previous Egregor attacks have resulted in threat actors stealing unencrypted files before locking victims out of essential back-end services. It is not currently clear if Kmart has had any data stolen or what kind of ransom is being demanded. Although Kmart’s online stores are still operating, the Transformco HR site appears to be down.
- We've put together a list of the best endpoint protection (opens in new tab) software
- Keep your devices virus-free with the best malware removal (opens in new tab) software
- Check out our roundup of the best ransomware protection (opens in new tab)
Retail ransomware
Kmart has not commented on the attack publicly but will no doubt be concerned that the ransomware attackers could begin leaking stolen information. Following some recent high-profile Egregor attacks, information was posted to a leak site, although nothing particularly sensitive was shared.
Nevertheless, the attack will not inspire much consumer confidence in the beleaguered Kmart chain. Once one of the best-known retail outlets in the US, it reportedly now has just 34 stores remaining nationwide. With the holiday shopping season underway, Kmart will be hoping that the ransomware disruption does not affect sales.
Ransomware attacks have been in the spotlight of late, with recent research finding that 65% (opens in new tab) of global organizations suffered a ransomware infection last year. Often, when one attack vector is closed down, ransomware attackers simply move on to a new one. This appears to be the case with some of the Egregor attacks, which seem to have attracted threat actors from the now-defunct Maze ransomware campaign (opens in new tab).
- We've also highlighted the best antivirus (opens in new tab) software
Via Bleeping Computer (opens in new tab)
