Victoria’s data is not so secret

Hold on to your lacy lingerie britches: Victoria’s Secret has taken down its website and paused all online orders in response to an ongoing cyberattack that began on Wednesday. 

And, while the retailer has provided few concrete details, the hack could be tied to an arachnid-inspired group with a bit of practice in this realm.

Spidey senses are tingling

Two weeks ago, Google warned that a cybercriminal group called Scattered Spider—mostly comprised of young US and UK residents—is starting to target major American retail brands after carrying out a series of hacks targeting UK retailers.

• Retail giant Marks & Spencer, one of the best known names in British business, has been unable to take online orders since April 25.
• The Co-op Group, a major UK food retailer, experienced a customer data breach, also in late April.
• Luxury department store Harrod’s saw a brief disruption in late April/early May that saw some locations taken offline as a security measure.

Following each attack, Scattered Spider appears to have handed its findings over to Russian cybercriminal group DragonForce, which makes money by extorting victims with sensitive data.

Looking ahead…Victoria’s Secret has yet to provide an estimate for when its systems will come back online, though all ~1,350 brick-and-mortar stores remain open for business.