Staples Hit with Third Lawsuit Over Ransomware Attack Exposing Employee Data Staples Inc. faces its third lawsuit in two weeks following a reported cyberattack by the ransomware group CoinbaseCartel, which may have compromised employee data. The latest legal action, filed in Boston, adds to mounting legal pressure on the retail giant as affected workers allege negligence in safeguarding sensitive information. The attack, disclosed earlier this month, has raised concerns about the extent of data exposure, though specifics on the number of impacted employees or the type of compromised data remain unclear. The ransomware group, known for targeting corporate networks, has not publicly claimed responsibility, but the timing and nature of the breach align with its tactics. The lawsuits highlight growing scrutiny over corporate cybersecurity practices, particularly in cases where employee data is at risk. Staples has not yet issued a detailed public statement on the breach’s scope or its response efforts. The legal proceedings will likely focus on whether the company took adequate measures to prevent the attack and mitigate its impact. As the case unfolds, it underscores the rising threat of ransomware attacks on major retailers and the legal repercussions of failing to protect employee information.

After a cyberattack, American office supplies store Staples pulled down a few of its systems to limit the impact of the intrusion and safeguard consumer information. The revelation follows numerous Reddit posts that detailed issues with Staples' internal operations, including the inability to use phone lines, print emails, access employee portals via VPNs, use Zendesk, and more. Unverified rumours claim that call centre workers were sent home for two days in a row and that Staples staff members were told not to use single sign-on (SSO) to access Microsoft 365. When Bleeping Computer contacted Staples to inquire about the integrity of these reports, the retailer acknowledged that it had to take precautionary measures to lessen what it called a cybersecurity risk.

The California Office of the Attorney General reported that Staples, Inc. experienced a data breach involving unauthorized access to payment card data from customers' purchases. The breach was detected on December 19, 2014, and affected purchases made at 115 retail stores from August 10, 2014, through September 16, 2014, potentially compromising cardholder names, payment card numbers, expiration dates, and card verification codes.