Retail Leak-Site Listings Rose 30% as Phishing Surged, ReliaQuest Reports
Summary
ReliaQuest reports retail organizations named on data-leak sites rose 30% to 165 this quarter, while phishing's share of attacks climbed to 39% from 15%. It recommends stronger brand monitoring, patching, access controls and automated response.
Key points
- ReliaQuest says retail organizations named on data-leak sites rose 30% to 165; The Gentlemen led postings, while Settra and Play appeared in the latest period.
- Phishing's share of attacks targeting retail rose to 39% from 15%; Spearphishing Link became the leading technique, with other spearphishing methods also gaining share.
- Digital risk alerts included impersonating domains (43%), impersonating subdomains (25%) and open-port exposure (14%), which had risen from negligible levels.
- The report says attackers exploited 109 new vulnerabilities during the quarter, up 76%; 59 were exploited within five days of disclosure and 32 on the same day. It also cites active exploitation of CVE-2026-50522 affecting on-premises SharePoint Server.
- Retail faced an actively exploited critical Cisco Catalyst SD-WAN Manager flaw; the article also says CVE-2026-76504 can bypass API authentication and had no patch available at report time.
- Retail mean time to contain improved 48%, from 2 hours 20 minutes to 1 hour 13 minutes; organizations using Automated Response Playbooks reportedly contained threats in an average of 5 minutes.
- Recommended measures include monitoring brand impersonation, hardening exposed services, restricting remote administration, enforcing MFA, and automating responses to high-confidence threats.
Article Details
- Publisher
- Reliaquest
- Report Period
- This quarter; calendar dates not specified
- Scope
- Retail trade ransomware postings, initial access, exposure, and response observations
- Key Statistics
- Retail trade organizations named on data-leak sites rose 30% to 165.
- Phishing's share of attacks targeting retail trade rose to 39%, from 15%.
- The report says attackers exploited 109 new vulnerabilities, up 76%; 59 were exploited within five days of disclosure and 32 on the day of disclosure.
- Retail trade mean time to contain improved 48%, from 2 hours 20 minutes to 1 hour 13 minutes; organizations using Automated Response Playbooks averaged 5 minutes.
- Retail digital risk protection alerts included impersonating domains at 43%, impersonating subdomains at 25%, credential exposures at 14%, and open-port exposure at 14%.
- Recommendations
- Continuously track lookalike domains and subdomains, prioritize takedowns tied to login and payment workflows, and correlate brand-abuse alerts with identity telemetry.
- Validate WAF rules against encoding bypasses, patch SharePoint Server promptly, and monitor for abnormal SharePoint key access, new web shells, and unexpected service-account activity.
- Follow Cisco advisories, restrict internet exposure and API access to trusted IPs, monitor anomalous administrator and API activity, and validate SD-WAN configurations.
- Enforce MFA on VPN and RDP, tighten remote administration, and patch internet-facing edge devices quickly.
- Use application allowlisting to block Rclone and AnyDesk, and tune EDR to detect credential dumping and PsExec execution.
MITRE ATT&CK
T1003 · OS Credential DumpingCredential dumping is identified as a ransomware-adjacent behavior for which the report recommends EDR detection.T1534 · Internal SpearphishingInternal Spearphishing is reported among the initial-access techniques gaining share.T1566.001 · Spearphishing AttachmentSpearphishing Attachment is reported among the initial-access techniques gaining share.T1566.002 · Spearphishing LinkSpearphishing Link is reported as a leading initial-access method targeting retail trade.T1569.002 · Service ExecutionThe report identifies PsExec execution as a ransomware-adjacent behavior for which it recommends EDR detection.
CVE
CVE-2026-50522Microsoft · Microsoft SharePoint Enterprise Server 2016; Microsoft · Microsoft SharePoint Server 2019; +1 morethe reporting period: URI encoding techniques that bypass WAF path rules, and active exploitation of CVE-2026-50522 on on-premises SharePoint Server, which can enable remote code execution and theft of machine keysCVE-2026-76504Cisco · Cisco Catalyst SD-WAN Managernetwork infrastructure to unauthorized changes, service disruption, and broader operational risk. CVE-2026-76504 (CVSS 9.8) also affects Cisco Catalyst SD-WAN Manager and can bypass API authentication; a patch was
Threat Actors
JADEPUFFERThe report describes JADEPUFFER as involved in a cloud identity incident using exposed Azure service-principal credentials to delete storage, SQL databases, key vaults, and apps.PlayNamed as a ransomware group appearing on retail trade leak sites only in the latest period; the report says its postings were well above its cross-sector baseline.QilinNamed as a ransomware group whose retail trade leak-site postings persisted across both periods.SettraNamed as a ransomware group appearing on retail trade leak sites only in the latest period; the report says its postings were well above its cross-sector baseline.The GentlemenNamed as a ransomware group whose retail trade leak-site postings persisted across both periods; the report says it widened its lead and was the clearest current driver of retail postings.
Vendors
Products
Azureabuse. It also applies to disruptive cloud identity incidents such as “JADEPUFFER,” which used exposed Azure service principal credentials to delete storage, SQL databases, key vaults, and apps in hours—an outageCisco Catalyst SD-WAN Managerto distribution and payment. The reporting period flagged active exploitation of a critical Cisco Catalyst SD-WAN Manager flaw that can grant unauthenticated administrator access. For retail, one compromisedGreyMatterRetail trade teams need speed without losing control of response decisions across consumer, corporate, and supply chain environments. GreyMatter is built for that operating model.SharePoint Servertechniques that bypass WAF path rules, and active exploitation of CVE-2026-50522 on on-premises SharePoint Server, which can enable remote code execution and theft of machine keys for persistence. Validate WAF
Tools
AnyDeskcredential dumping, PsExec execution, and large outbound transfers via “Rclone” or remote tools such as AnyDesk. The report’s ransomware guidance aligns here: enforce MFA on VPN and RDP, patch internet-facing edgePsExecknown-malicious command-and-control, and ransomware-adjacent behaviors such as credential dumping, PsExec execution, and large outbound transfers via “Rclone” or remote tools such as AnyDesk. The report’sRClonebehaviors such as credential dumping, PsExec execution, and large outbound transfers via “Rclone” or remote tools such as AnyDesk. The report’s ransomware guidance aligns here: enforce MFA on VPN and