DragonForce Ransomware Group Strikes US Retailer Belk in Major Cyberattack The US department store chain Belk has fallen victim to a cyberattack by the DragonForce ransomware group, the same threat actor behind the recent £300 million ($403 million) attack on UK retailer Marks & Spencer (M&S). The breach, disclosed in early June via a filing with the New Hampshire Attorney General’s Office, involved unauthorized access to corporate systems and sensitive customer data. Researchers from Cybernews confirmed the legitimacy of the leak, which includes names, dates of birth, addresses, phone numbers, email addresses, and order histories data that could be exploited by malicious actors, data brokers, or insurance companies for profiling. The exposed information also encompasses store coupons, employee records, and data from Belk’s mobile app infrastructure. While the exact number of affected individuals remains unclear, estimates suggest up to a million users may be impacted, though some accounts are likely test profiles. DragonForce, which first emerged in 2023, has rapidly expanded its operations, targeting 104 organizations in the past year. The group operates a dark web blog where it lists victims and shares stolen data. In Belk’s case, attackers claim to have exfiltrated 156GB of company data, including backups and employee profiles. The gang initially stated it had no intention of "destroying" Belk’s business but resorted to destructive measures after the company refused to pay the ransom. The attack has had significant financial repercussions for M&S, forcing its online clothing operations offline, disrupting food supply chains, and wiping over £1 billion from its stock market value. Online sales and trading profits in the affected division have been "heavily impacted" due to the suspension of e-commerce services. Belk, founded in 1888, operates nearly 300 stores across 16 US states and reported $4 billion in revenue last year. The incident underscores the growing threat posed by ransomware groups like DragonForce, which has also hijacked infrastructure from rival gangs such as BlackLock, Mamona, and RansomHub in a bid to dominate the cybercriminal landscape.