Cybercriminal group targets multiple US retailers after wreaking havoc in UK

CNN

16-05-2025

Hackers linked to a notorious cybercriminal group have conducted cyberattacks on multiple US retail companies in the last 10 days, prompting the FBI to step up cyber-intelligence briefings for major companies in the sector, three sources familiar with the matter told CNN.
The criminal group – known for aggressively extorting major US corporations in recent years – is suspected of being involved in ransomware attacks on between three and five US retailers in recent days, the sources said.
The flurry of activity in the US tied to the cybercriminal group – a loose collection of hackers that the cyber industry calls Scattered Spider – has led the FBI and major technology companies like Google to urge US retailers to raise their digital defenses. The group is considered dangerous and unpredictable, in part because it is comprised of youths in the US and the UK known for aggressively extorting their victims.
Ahold Delhaize USA was targeted, which has the same parent company as the Giant and Food Lion grocery chains. The hackers managed to log into an account at one its US retail locations, but the incident was isolated and contained, according to an internal Ahold Delhaize report reviewed by CNN.
The FBI has been in touch with some of the major US retail brands to warn them of the threat from Scattered Spider, the sources said.
CNN has requested comment from Ahold Delhaize.
'We can confirm [a cybercriminal group] successfully targeted multiple retail organizations in the US,' said John Hultquist, chief analyst at Google Threat Intelligence Group, though he declined to name them.
Scattered Spider is suspected of being involved in a spate of ransomware attacks in the last month on major UK retail giants Harrods and Marks & Spencer. The latter company appeared hardest hit. The hackers stole customer data from Marks & Spencer and disrupted online orders.
Scattered Spider shot to infamy in September 2023 when they were linked to a pair of damaging hacks on famous Las Vegas casinos and hotels MGM Resorts and Caesars Entertainment.
The hacking group has 'a history of focusing their efforts on a single sector at a time, and we anticipate they will continue to target the sector in the near term,' Hulquist said. 'US retailers should take note.'
'US-based retailers are aware of the threats posted by cybercriminal groups that have recently attacked several major retailers in the United Kingdom, and many companies have taken steps to harden themselves against these criminal groups' tactics over the past two years,' Christian Beckner, a vice president at the National Retail Federation, said in a statement.