Ralph Lauren Hit by ShinyHunters Extortion Campaign, 140K Records Leaked Ralph Lauren has fallen victim to a "pay or leak" extortion attack by the cybercriminal group ShinyHunters, which this week published a trove of stolen personal data. The leaked dataset includes 140,000 email addresses, names, phone numbers, and other sensitive information approximately 85% of which was already publicly available on LinkedIn. The breach highlights the growing trend of double-extortion tactics, where threat actors not only encrypt data but also threaten to release it unless a ransom is paid. While the full scope of the incident remains unclear, the exposure of such a large volume of personal data raises concerns about potential phishing, identity theft, and further targeted attacks. The incident underscores the risks posed by third-party data aggregation, as much of the leaked information appears to have been sourced from publicly accessible platforms. No details on ransom demands or Ralph Lauren’s response have been disclosed at this time.

Ralph Lauren Investigates Potential Supply Chain Cyberattack Linked to Extortion Group Ralph Lauren is reportedly investigating a suspected cyberattack that may have compromised its supply chain through a third-party vendor. The incident, which did not directly target the company’s own systems, highlights a growing trend of threat actors exploiting weaker security in partner networks to gain access to larger organizations. No details have been released about the scope of the breach, including what data may have been exposed or whether the impact extends beyond U.S. users. Ralph Lauren has not publicly confirmed the unauthorized access. The attack has been claimed by CoinbaseCartel, a cybercriminal group operating on the dark web. The same group also asserts responsibility for breaches at other U.S. companies, including children’s retailer Carter’s and jewelry chain Helzberg Diamonds. Emerging in September 2024, CoinbaseCartel has rapidly become one of the most active extortion gangs, with over 130 claimed victims across sectors such as healthcare, technology, telecommunications, finance, and transportation. Its targets have included major corporations like SK Telecom (South Korea), Plug Power (U.S.), NTT Data (Japan), and CEVA Logistics (Switzerland). While the group’s origins remain unclear, some cybersecurity analysts suggest potential ties to established threat actors like ShinyHunters, Scattered Spider, or LAPSUS$, possibly operating as affiliates. Despite its name, CoinbaseCartel has no connection to the cryptocurrency exchange Coinbase. The full extent of the Ralph Lauren incident and its broader implications remains under investigation.