Kmart is latest retailer to suffer major ransomware attack

security
(Image credit: Shutterstock / binarydesign)

US retailer Kmart has become the latest business to face disruption as a result of a ransomware attack. According to reports, the attack encrypted a number of servers operating on the Transformco network owned by Transform Holdco, which acquired Sears and Kmart back in 2019.

Bleeping Computer reports that the attack has been traced to the Egregor ransomware operation, which has also targeted a number of other organizations, including Barnes and Noble, Ubisoft, and Crytek.

Previous Egregor attacks have resulted in threat actors stealing unencrypted files before locking victims out of essential back-end services. It is not currently clear if Kmart has had any data stolen or what kind of ransom is being demanded. Although Kmart’s online stores are still operating, the Transformco HR site appears to be down.

Retail ransomware

Kmart has not commented on the attack publicly but will no doubt be concerned that the ransomware attackers could begin leaking stolen information. Following some recent high-profile Egregor attacks, information was posted to a leak site, although nothing particularly sensitive was shared.

Nevertheless, the attack will not inspire much consumer confidence in the beleaguered Kmart chain. Once one of the best-known retail outlets in the US, it reportedly now has just 34 stores remaining nationwide. With the holiday shopping season underway, Kmart will be hoping that the ransomware disruption does not affect sales.

Ransomware attacks have been in the spotlight of late, with recent research finding that 65% of global organizations suffered a ransomware infection last year. Often, when one attack vector is closed down, ransomware attackers simply move on to a new one. This appears to be the case with some of the Egregor attacks, which seem to have attracted threat actors from the now-defunct Maze ransomware campaign.

Via Bleeping Computer

Barclay Ballard

Barclay has been writing about technology for a decade, starting out as a freelancer with ITProPortal covering everything from London’s start-up scene to comparisons of the best cloud storage services.  After that, he spent some time as the managing editor of an online outlet focusing on cloud computing, furthering his interest in virtualization, Big Data, and the Internet of Things. 

Latest in Security
Data leak
Top home hardware firm data leak could see millions of customers affected
Representational image depecting cybersecurity protection
Third-party security issues could be the biggest threat facing your business
A stylized depiction of a padlocked WiFi symbol sitting in the centre of an interlocking vault.
Broadcom warns of worrying security flaws affecting VMware tools
Android Logo
Devious new Android malware uses a Microsoft tool to avoid being spotted
URL phishing
HaveIBeenPwned owner suffers phishing attack that stole his Mailchimp mailing list
Ransomware
Cl0p resurgence drives ransomware attacks to new highs in 2025
Latest in News
An image of Pro-Ject's Flatten it closed and opened
Pro-Ject’s new vinyl flattener will fix any warped LPs you inadvertently buy on Record Store Day
EA Sports F1 25 promotional image featuring drivers Oscar Piastri, Carlos Sainz and Oliver Bearman.
F1 25 has been officially announced, with this year's entry marking a return for Braking Point and a 'significant overhaul' for My Team mode
Garmin clippd integration
Garmin's golf watches just got a big software integration upgrade to help you improve your game
Robert Downey Jr reveals himself as Doctor Doom to a delighted crowd at San Diego Comic-Con 2024
Marvel is currently revealing the full cast for Avengers: Doomsday, and I think it's going to be a long-winded announcement
Samsung QN90F on yellow background
Samsung announces US prices for its 2025 mini-LED TV lineup, and it’s good and bad news
Nintendo Switch Lite
Forget the Nintendo Switch 2, the original Switch is getting one last hurrah in a surprise Nintendo Direct tomorrow