Inditex Confirms Third-Party Cybersecurity Breach Impacting Transaction Databases Inditex, the parent company of global fashion retailer Zara, disclosed a cybersecurity incident late Wednesday involving unauthorized access to transaction databases hosted by a third-party provider. The breach, linked to a former technology vendor, did not expose sensitive customer data such as names, addresses, passwords, or payment details, according to the company. The incident highlights the growing risks of third-party vulnerabilities in retail cybersecurity. Inditex confirmed that multiple international companies were affected, suggesting a shared infrastructure flaw. While the company activated internal security protocols and notified authorities immediately, it has not released the name of the compromised provider or technical details of the breach, citing ongoing investigations. Though no financial or personal data was compromised, the incident underscores the challenges of vendor-dependent operations. Retailers increasingly rely on external partners for data management, creating potential entry points for cyber threats outside direct corporate control. Industry experts, including the Cybersecurity and Infrastructure Security Agency (CISA), have long warned that third-party providers can serve as weak links in otherwise secure systems. Inditex emphasized that only transaction-related information likely operational or logistical records was accessed, reducing immediate risk but raising concerns about system integrity and vendor oversight. The breach serves as a reminder of the interconnected nature of modern business systems, where a single vulnerability can ripple across multiple organizations. For now, Inditex has framed the incident as contained, with no evidence of customer data exposure. However, the broader retail sector will likely scrutinize the fallout as investigations continue, reinforcing the need for robust third-party risk management.

Ransomware Attacks Surge in 2025, Driven by Russian-Linked Groups and AI Exploitation In 2025, ransomware attacks claimed on dark-web leak sites jumped nearly 20%, reaching 6,883 incidents, while the number of leak sites themselves grew by a third to 115, according to Bitsight’s annual "State of the Underground" report. A small group of threat actors 10 in total, half tied to Russia accounted for 58% of all attacks, highlighting a concentrated cybercriminal ecosystem. The U.S. bore the brunt of the impact, with 60% of victims located in the country, while the manufacturing sector emerged as the most targeted industry. Meanwhile, traditional data breaches declined by 41%, though Bitsight attributed the drop to reporting gaps and shifting attacker tactics rather than reduced risk. Threat actors increasingly focused on "domino-effect" targets, including critical infrastructure, defense, government, and utilities. A sectoral shift was also evident in breach trends: educational institutions suffered the most breaches (505), followed by government (475) and IT (469) a reversal from 2024, when IT led with 1,210 breaches. The report noted that breaches in 2025 were "more distributed" across industries handling PII, operational data, and supply chain assets. AI’s dual role in cybersecurity became more pronounced. While defenders leveraged AI tools, hackers increasingly exploited them, with 5.1 million mentions of Google’s Gemini, 1.4 million of OpenAI’s ChatGPT, and hundreds of thousands more for Claude and Grok on cybercrime forums. Poorly secured AI platforms also created new vulnerabilities: publicly exposed AI tools surged 360%, exceeding 1 million instances, with n8n and Open WebUI both plagued by serious flaws leading the rise. Bitsight warned that the shrinking window between vulnerability discovery and exploitation demands faster response times, as both attackers and defenders race to leverage AI for advantage. The report underscored that traditional patching schedules are no longer sufficient in this accelerated threat landscape.