[Blog](/blog) Show links Resources [Blog](/blog) [Breaches](/breaches) [eBooks, reports, & more](/resources) [Events](/events) [News](/news) [Cybersecurity](/category/cybersecurity) Show links Categories [Attack Surface Management](/category/attack-surface-management) [Company News](/category/company-news) [Compliance and Regulations](/category/compliance-and-regulations) [Cybersecurity](/category/cybersecurity) [Data Breaches](/category/data-breaches) [DevOps](/category/devops) [Human Cyber Risk](/category/human-cyber-risk) [Risks and Vulnerabilities](/category/risks-and-vulnerabilities) [Third-Party Risk Management](/category/third-party-risk-management) [Vendor Risk Management](/category/vendor-risk-management) [10 Black Friday Cybersecurity Incidents That Prove Attackers Use Peak Retail Traffic to Hide](/blog/10-black-friday-cybersecurity-incidents-prove-attackers-hide) Publish date October 26, 2026 {x} minute read # 10 Black Friday Cybersecurity Incidents That Prove Attackers Use Peak Retail Traffic to Hide [Get a demo](/contact-sales) [Free trial](/demo) [Download the PDF guide](#) [Free trial](/demo) Written by [Revashni Moodley](/team/revashni-moodley) Content Writer Revi is a cyber writer with a background in business analysis and data management. Reviewed by [Kaushik Sen](/team/kaushik-sen) Chief Marketing Officer Kaushik has a background in software engineering, enterprise solution architecture, and data analytics. He brings a unique, data-driven perspective to cybersecurity education. Table of contents Free resource ### [Download now](#) In the weeks before Black Friday, phones buzz incessantly with sales alerts, delivery updates, application update requests, and order confirmations. Most get swiped away. On October 6, 2026, ASOS app users received a notification designed to catch their attention. Titled “ASOS HACKED,” it addressed the retailer’s own data protection and IT teams, claimed that attackers had already compromised its Snowflake cloud data platform, and told ASOS to engage with them or face a leak. One impersonated contact and one employee login gave attackers access to the third-party platforms ASOS uses to message customers. The alert was sent on an ordinary Tuesday in early October, with Black Friday less than eight weeks away. The holiday season’s risk window opens weeks before the shopping does. Ransomware crews clock in when security teams clock out. A [2021 joint advisory](https://www.cisa.gov/news-events/alerts/2021/08/31/fbi-cisa-advisory-ransomware-awareness-holidays-and-weekends) from the FBI and the Cybersecurity and Infrastructure Security Agency observed an increase in serious ransomware attacks on holidays and weekends, when offices are normally closed. ASOS is the latest in a pattern that stretches back more than a decade. Here are 10 incidents that hit retailers and shoppers in the weeks around Black Friday. ## 1. Open season: Coupang data breach (2025) exposed 33 million accounts **When it surfaced:** November 29, 2025, the day after Black Friday South Korean e-commerce giant Coupang[ disclosed a breach](https://www.theregister.com/2025/12/01/coupang_breach/) after detecting suspicious activity on November 18 and first counting about 4,500 accounts.[ ](https://sbsstar.net/article/N1008605711/pipc-imposes-record-fine-of-up-to-625-billion-won-on-coupang-after-13hour-deliberation)South Korea's [privacy regulator](https://sbsstar.net/article/N1008605711/pipc-imposes-record-fine-of-up-to-625-billion-won-on-coupang-after-13hour-deliberation) later found that a former developer used a signing key obtained while employed to forge access tokens between April and November 2025. The breach exposed the data of [33.7 million members](https://asianews.network/south-korea-calls-coupang-breach-of-33-7m-records-worst-ever/) and at least 4.3 million non-members. Coupang said the exposed data included names, email addresses, phone numbers, shipping addresses, and some order histories, and that payment details and login credentials remained secure. The company was[ ](https://cyberinsider.com/coupang-hit-by-massive-456-million-fine-for-2025-data-breach-incident/)fined [624.68 billion won](https://cyberinsider.com/coupang-hit-by-massive-456-million-fine-for-2025-data-breach-incident/) (about $409 million) in total, including 423.6 billion won for the breach itself. ## 2. Buy one, get three free: Blue Yonder ransomware attack (2024) hit Starbucks, Morrisons, and BIC **When it surfaced:** November 21, 2024, a week before Thanksgiving Supply chain software provider Blue Yonder, which serves about 3,000 customers,[ reported ransomware](https://www.bleepingcomputer.com/news/security/blue-yonder-ransomware-attack-disrupts-grocery-store-supply-chain/) in its managed services environment, where it hosts and runs customers’ software.[ ](https://dc.fortune.com/2024/11/25/starbucks-is-using-pens-and-paper-to-track-pay-after-vendor-hack/)Starbucks tallied [hours and pay by hand](https://dc.fortune.com/2024/11/25/starbucks-is-using-pens-and-paper-to-track-pay-after-vendor-hack/) for company-operated stores in the US and Canada. Morrisons switched to backup systems for fresh food logistics, and BIC reported shipping delays.[ ](https://www.bleepingcomputer.com/news/security/blue-yonder-saas-giant-breached-by-termite-ransomware-gang/amp/)The Termite Ransomware group later claimed the attack and said it had stolen 680GB of data, including email lists and insurance documents. Blue Yonder said it was [investigating the claim](https://www.cybersecuritydive.com/news/blue-yonder-data-leak-ransomware/734987/). ## 3. While stocks last: Ahold Delhaize cyberattack (2024) left Stop & Shop shelves bare **When it surfaced:** November 8, 2024, about three weeks before Thanksgiving Ahold Delhaize USA[ ](https://amp.insurancejournal.com/news/east/2024/11/13/801009.htm)confirmed a [cybersecurity incident](https://amp.insurancejournal.com/news/east/2024/11/13/801009.htm) and took some systems offline, which affected pharmacies and e-commerce at several of its brands. Shoppers found bare produce, meat, and poultry shelves at a [Stop & Shop](https://www.wbur.org/news/2024/11/14/stop-shop-product-shortage-empty-shelves-cybersecurity-incident) south of Boston, and Hannaford halted online pickup and delivery orders for several days, with its website still offline on November 13. Ahold Delhaize later confirmed that[ ](https://www.grocerydive.com/news/ahold-delhaize-confirms-data-stolen-cybersecurity-threat-group/745727/)attackers had [stolen files](https://www.grocerydive.com/news/ahold-delhaize-confirms-data-stolen-cybersecurity-threat-group/745727/) from its US operations, and the INC Ransom group claimed responsibility. The company told regulators the breach affected [2,242,521 people](https://www.securityweek.com/ahold-delhaize-data-breach-impacts-2-2-million-people/), mostly current and former employees and their dependents, with exposed data that included Social Security numbers, financial account details, and health information. ## 4. Sold out online: Fourlis Group cyberattack (2024) hit IKEA stores across four countries **When it surfaced:** December 3, 2024, four days after Black Friday Fourlis Group, which operates IKEA stores in Greece, Cyprus, Romania, and Bulgaria as a franchisee, disclosed in early December that a malicious [external attack](https://www.cyberdaily.au/security/11984-ikea-lost-millions-after-2024-black-friday-cyber-attack) on its digital and electronic systems had occurred. Media reports identified the attack as ransomware. The disruption affected store replenishment and e-commerce from December 2024 into February 2025, costing about [€15 million in sales](https://www.techzine.eu/news/security/130507/ransomware-attack-on-ikea-operator-costs-e20-million/) in December and another €5 million in 2025. Fourlis said its [forensic report](https://www.bleepingcomputer.com/news/security/ransomware-attack-cost-ikea-operator-in-eastern-europe-23-million/) did not prove a personal data leak, and it notified data protection authorities in all four countries. Fourlis declined to pay the ransom, and no one has claimed the attack. ## 5. In-store only: Krispy Kreme cyberattack (2024) detected on Black Friday **When it surfaced:** November 29, 2024, Black Friday (SEC filing on December 11) Krispy Kreme was notified of unauthorized activity on parts of its internal network on November 29, 2024. Its filing with the[ US Securities and Exchange Commission](https://www.sec.gov/Archives/edgar/data/1857154/000185715424000123/dnut-20241211.htm) reported disruption to online ordering in parts of the United States, a channel that made up 15.5% of sales in the third quarter. Shops stayed open for in-person orders, and the[ Play ransomware group](https://www.bleepingcomputer.com/news/security/krispy-kreme-breach-data-theft-claimed-by-play-ransomware-gang/amp/) later claimed the attack. An investigation that concluded in May 2025 found that attackers had stolen personal information from 161,676 people, mostly current and former employees and their families. The stolen data included Social Security numbers, financial account details, and passport numbers. Krispy Kreme estimated the attack cost about [$5 million](https://therecord.media/krispy-kreme-reports-data-breach-from-2024-attack). ## 6. Lowest prices of the year: SilkSpecter's 4,695 fake stores (2024) targeted Black Friday shoppers **When it surfaced:** October to mid-November 2024, ahead of Black Friday EclecticIQ researcher Arda Buyukkaya found a group dubbed SilkSpecter, operating[ 4,695 fraudulent shopping domains](https://www.bleepingcomputer.com/news/security/fraud-network-uses-4-700-fake-shopping-sites-to-steal-credit-cards/) by mid-November 2024. The campaign began in October. The sites impersonated brands including The North Face, Lidl, Wayfair, and IKEA, and many included the words *Black Friday* in their[ web addresses](https://www.pcworld.com/article/2522574/watch-out-for-fake-online-stores-as-black-friday-approaches.html). They used the Stripe payment processor to appear legitimate, while the fake checkout pages sent card details, authentication data, and phone numbers to attacker-controlled servers. EclecticIQ assessed that the card details could fund financial fraud, and that the phone numbers could power a second stage of [voice and text phishing](https://blog.knowbe4.com/phishing-campaign-targets-black-friday-shoppers) aimed at 2FA codes and account credentials. ## 7. Free gift card: Storm-0539 gift card fraud (2023) ramped up 60% over the holiday season **When it surfaced:** Mid-December 2023, about two weeks after Black Friday Microsoft tracked [Storm-0539](https://www.microsoft.com/en-us/security/security-insider/threat-landscape/cyber-signals-issue-7-inside-the-growing-risk-of-gift-card-fraud), a Morocco-based group that targets the gift card systems of large retailers, luxury brands, and fast-food chains. Microsoft observed a[ 60% increase](https://thehackernews.com/2023/12/microsoft-warns-of-storm-0539-rising.html) in the group's intrusion activity over that period. The group phishes employee credentials, registers its own device to pass multi-factor authentication, and then issues gift cards to itself. Microsoft warns that this kind of fraud can cost a victim[ ](https://infosecurity-magazine.com/news/microsoft-gift-card-fraud-costing)up to [$100,000 a day](https://infosecurity-magazine.com/news/microsoft-gift-card-fraud-costing). ## 8. Cyber Monday special: Staples cyber attack (2023) stalled online orders and deliveries **When it surfaced:** November 27, 2023, Cyber Monday, three days after Black Friday Staples' cybersecurity team[ identified a threat](https://www.bleepingcomputer.com/news/security/staples-confirms-cyberattack-behind-service-outages-delivery-issues/) on Cyber Monday and took some systems offline in response. Staples described it only in general terms, and said its response caused "temporary disruption to our backend processing and delivering capabilities," which held up orders on Staples.com and affected customer service lines.[ ](https://www.retaildive.com/news/staples-cyberattack-cyber-week/701305)Staples brought numerous systems [back online](https://www.retaildive.com/news/staples-cyberattack-cyber-week/701305) by that Wednesday and the rest by Thursday, and had expected to clear its November order backlog by Friday. Staples said no data was encrypted, and that it was too early to say whether customer data had been affected. Its stores kept operating throughout. ## 9. Exclusive offer inside: IKEA reply-chain phishing attack (2021) slipped into employees’ existing email threads **When it surfaced:** November 26, 2021, Black Friday (date of the first report) IKEA appears on this list three times. This attack came three years before the Fourlis attack above. [BleepingComputer reported](https://www.bleepingcomputer.com/news/security/ikea-email-systems-hit-by-ongoing-cyberattack/) that IKEA warned employees about an ongoing phishing attack on internal mailboxes. The attackers used stolen email reply chains, so the malicious messages arrived as replies in conversations employees were already having. IKEA's internal warning said the same attack had compromised other IKEA organizations, suppliers, and business partners, who were spreading the malicious emails further.[ ](https://www.furnituretoday.com/technology/hackers-hit-ikea-with-reply-chain-email-attack)An IKEA spokesperson [confirmed the phishing attack](https://www.furnituretoday.com/technology/hackers-hit-ikea-with-reply-chain-email-attack) and said the company had no indication that customer data was compromised. ## 10. VIP access: Target data breach (2013) began with a vendor's stolen login **When it surfaced:** November 27, 2013, two days before Black Friday (confirmed publicly on December 19, 2013) Card theft at [Target's US stores](https://corporate.target.com/press/release/2013/12/target-confirms-unauthorized-access-to-payment-card-data-in-u-s-stores) began that day and ran until December 15.[ State investigators](https://illinoisattorneygeneral.gov/News-Room/2006-2018-Press-Archive/201705-23%20ATTORNEY%20GENERAL%20MADIGAN%20ANNOUNCES%2018.5%20MILLION%20SETTLEMENT%20WITH%20TARGET%20OVER%20DATA%20BREACH.pdf) later found that attackers accessed Target's gateway server using credentials stolen from a third-party HVAC vendor on or about November 12. The breach affected more than 41 million payment card accounts and the contact details of more than 60 million customers.[ ](https://www.bankinfosecurity.com/target-reaches-185-million-breach-settlement-states-a-9942)Target paid [$18.5 million to settle](https://www.bankinfosecurity.com/target-reaches-185-million-breach-settlement-states-a-9942) with 47 states and the District of Columbia in 2017. ‍ Free resource ### [Download now](#) ## Related posts Learn more about the latest issues in cybersecurity. Cybersecurity #### [12 Cybersecurity Horror Stories of 2026 (No Costume Required)](/blog/cybersecurity-horror-stories-2026) A warning ignored once becomes a headline. Read more about these 12 real 2026 cybersecurity incidents, and the sign each one gave before it made the news. [](/team/revashni-moodley) [Revashni Moodley](#) October 14, 2026 Cybersecurity #### [Left Unsupervised: 10 Times Access Outlived Its Authorization](/blog/10-times-access-outlived-authorization) Access granted once shouldn’t mean access forever. Read more on how unmonitored access caused 10 of these real-life breaches and what they taught us. [](/team/revashni-moodley) [Revashni Moodley](#) August 25, 2026 Cybersecurity #### [Surviving a LockBit Ransomware Attack: The ROI of Visibility](/blog/surviving-a-lockbit-ransomware-attack) Read how veteran CISO Nick Gicinto saved his alma mater from a LockBit ransomware attack by discarding the standard playbook. [](/team/nicholas-sollitto) [Nicholas Sollitto](#) June 1, 2026 Cybersecurity #### [Top 10 Security Events of 2025](/blog/top-security-events-of-2025) Recap the ten most impactful events that reshaped the cybersecurity industry this year and the critical lessons each had to teach us. Read more here. [](/team/revashni-moodley) [Revashni Moodley](#) October 14, 2026 Cybersecurity #### [Risk Automations: The Shift From Catch-Up to Command](/blog/risk-automations-shift-catch-up-to-command) Connect intelligence to system execution with Risk Automations, your new resolution layer for risk. Reduce remediation from hours to seconds - read more. [](/team/revashni-moodley) [Revashni Moodley](#) December 1, 2025 Cybersecurity #### [Shai-Hulud's True Lesson for CISOs: A Crisis of Communication](/blog/shai-hulud-lesson-for-cisos) Shai-Hulud was driven by a communication crisis between security and engineering. Get a CISO's perspective on how to finally bridge this gap. [](/team/phil-ross) [Phil Ross](#) September 3, 2026 [All posts](/blog) Experience superior visibility and a simpler approach to cyber risk management [Get a demo](/contact-sales) [Free trial](/demo)