10 Black Friday Cybersecurity Incidents That Prove Attackers Use Peak Retail Traffic to Hide

In the weeks before Black Friday, phones buzz incessantly with sales alerts, delivery updates, application update requests, and order confirmations. Most get swiped away. On October 6, 2026, ASOS app users received a notification designed to catch their attention. Titled “ASOS HACKED,” it addressed the retailer’s own data protection and IT teams, claimed that attackers had already compromised its Snowflake cloud data platform, and told ASOS to engage with them or face a leak.

One impersonated contact and one employee login gave attackers access to the third-party platforms ASOS uses to message customers.

The alert was sent on an ordinary Tuesday in early October, with Black Friday less than eight weeks away. The holiday season’s risk window opens weeks before the shopping does. Ransomware crews clock in when security teams clock out. A 2021 joint advisory from the FBI and the Cybersecurity and Infrastructure Security Agency observed an increase in serious ransomware attacks on holidays and weekends, when offices are normally closed.

ASOS is the latest in a pattern that stretches back more than a decade. Here are 10 incidents that hit retailers and shoppers in the weeks around Black Friday.

1. Open season: Coupang data breach (2025) exposed 33 million accounts

When it surfaced: November 29, 2025, the day after Black Friday

South Korean e-commerce giant Coupang disclosed a breach after detecting suspicious activity on November 18 and first counting about 4,500 accounts. South Korea's privacy regulator later found that a former developer used a signing key obtained while employed to forge access tokens between April and November 2025. The breach exposed the data of 33.7 million members and at least 4.3 million non-members. Coupang said the exposed data included names, email addresses, phone numbers, shipping addresses, and some order histories, and that payment details and login credentials remained secure. The company was fined 624.68 billion won (about $409 million) in total, including 423.6 billion won for the breach itself.

2. Buy one, get three free: Blue Yonder ransomware attack (2024) hit Starbucks, Morrisons, and BIC

When it surfaced: November 21, 2024, a week before Thanksgiving

Supply chain software provider Blue Yonder, which serves about 3,000 customers, reported ransomware in its managed services environment, where it hosts and runs customers’ software. Starbucks tallied hours and pay by hand for company-operated stores in the US and Canada. Morrisons switched to backup systems for fresh food logistics, and BIC reported shipping delays. The Termite Ransomware group later claimed the attack and said it had stolen 680GB of data, including email lists and insurance documents. Blue Yonder said it was investigating the claim.

3. While stocks last: Ahold Delhaize cyberattack (2024) left Stop & Shop shelves bare

When it surfaced: November 8, 2024, about three weeks before Thanksgiving

Ahold Delhaize USA confirmed a cybersecurity incident and took some systems offline, which affected pharmacies and e-commerce at several of its brands. Shoppers found bare produce, meat, and poultry shelves at a Stop & Shop south of Boston, and Hannaford halted online pickup and delivery orders for several days, with its website still offline on November 13. Ahold Delhaize later confirmed that attackers had stolen files from its US operations, and the INC Ransom group claimed responsibility. The company told regulators the breach affected 2,242,521 people, mostly current and former employees and their dependents, with exposed data that included Social Security numbers, financial account details, and health information.

4. Sold out online: Fourlis Group cyberattack (2024) hit IKEA stores across four countries

When it surfaced: December 3, 2024, four days after Black Friday

Fourlis Group, which operates IKEA stores in Greece, Cyprus, Romania, and Bulgaria as a franchisee, disclosed in early December that a malicious external attack on its digital and electronic systems had occurred. Media reports identified the attack as ransomware. The disruption affected store replenishment and e-commerce from December 2024 into February 2025, costing about €15 million in sales in December and another €5 million in 2025. Fourlis said its forensic report did not prove a personal data leak, and it notified data protection authorities in all four countries. Fourlis declined to pay the ransom, and no one has claimed the attack.

5. In-store only: Krispy Kreme cyberattack (2024) detected on Black Friday

When it surfaced: November 29, 2024, Black Friday (SEC filing on December 11)

Krispy Kreme was notified of unauthorized activity on parts of its internal network on November 29, 2024. Its filing with the US Securities and Exchange Commission reported disruption to online ordering in parts of the United States, a channel that made up 15.5% of sales in the third quarter. Shops stayed open for in-person orders, and the Play ransomware group later claimed the attack. An investigation that concluded in May 2025 found that attackers had stolen personal information from 161,676 people, mostly current and former employees and their families. The stolen data included Social Security numbers, financial account details, and passport numbers. Krispy Kreme estimated the attack cost about $5 million.

6. Lowest prices of the year: SilkSpecter's 4,695 fake stores (2024) targeted Black Friday shoppers

When it surfaced: October to mid-November 2024, ahead of Black Friday

EclecticIQ researcher Arda Buyukkaya found a group dubbed SilkSpecter, operating 4,695 fraudulent shopping domains by mid-November 2024. The campaign began in October. The sites impersonated brands including The North Face, Lidl, Wayfair, and IKEA, and many included the words Black Friday in their web addresses. They used the Stripe payment processor to appear legitimate, while the fake checkout pages sent card details, authentication data, and phone numbers to attacker-controlled servers. EclecticIQ assessed that the card details could fund financial fraud, and that the phone numbers could power a second stage of voice and text phishing aimed at 2FA codes and account credentials.

7. Free gift card: Storm-0539 gift card fraud (2023) ramped up 60% over the holiday season

When it surfaced: Mid-December 2023, about two weeks after Black Friday

Microsoft tracked Storm-0539, a Morocco-based group that targets the gift card systems of large retailers, luxury brands, and fast-food chains. Microsoft observed a 60% increase in the group's intrusion activity over that period. The group phishes employee credentials, registers its own device to pass multi-factor authentication, and then issues gift cards to itself. Microsoft warns that this kind of fraud can cost a victim up to $100,000 a day.

8. Cyber Monday special: Staples cyber attack (2023) stalled online orders and deliveries

When it surfaced: November 27, 2023, Cyber Monday, three days after Black Friday

Staples' cybersecurity team identified a threat on Cyber Monday and took some systems offline in response. Staples described it only in general terms, and said its response caused "temporary disruption to our backend processing and delivering capabilities," which held up orders on Staples.com and affected customer service lines. Staples brought numerous systems back online by that Wednesday and the rest by Thursday, and had expected to clear its November order backlog by Friday. Staples said no data was encrypted, and that it was too early to say whether customer data had been affected. Its stores kept operating throughout.

9. Exclusive offer inside: IKEA reply-chain phishing attack (2021) slipped into employees’ existing email threads

When it surfaced: November 26, 2021, Black Friday (date of the first report)

IKEA appears on this list three times. This attack came three years before the Fourlis attack above. BleepingComputer reported that IKEA warned employees about an ongoing phishing attack on internal mailboxes. The attackers used stolen email reply chains, so the malicious messages arrived as replies in conversations employees were already having. IKEA's internal warning said the same attack had compromised other IKEA organizations, suppliers, and business partners, who were spreading the malicious emails further. An IKEA spokesperson confirmed the phishing attack and said the company had no indication that customer data was compromised.

10. VIP access: Target data breach (2013) began with a vendor's stolen login

When it surfaced: November 27, 2013, two days before Black Friday (confirmed publicly on December 19, 2013)

Card theft at Target's US stores began that day and ran until December 15. State investigators later found that attackers accessed Target's gateway server using credentials stolen from a third-party HVAC vendor on or about November 12. The breach affected more than 41 million payment card accounts and the contact details of more than 60 million customers. Target paid $18.5 million to settle with 47 states and the District of Columbia in 2017.

‍