News reaction: Carhartt cyber breach

Following reports of a cyber incident affecting retailer Carhartt, Matt Hull, VP of Cyber Intelligence and Response at NCC Group, discusses the growing threat of data extortion and why retailers remain a prime target for cyber criminals.

Matt Hull, VP of Cyber Intelligence and Response as NCC Group commented:

"The reported breach affecting Carhartt highlights the persistent threat facing major retail brands, particularly those that hold significant volumes of customer data. Retail organisations remain highly attractive targets for cyber criminals because they combine valuable personal information with complex digital and third-party ecosystems, creating multiple avenues for compromise."

"The threat actor linked to this incident, ShinyHunters, has established itself as one of the most prolific data extortion groups operating today. Rather than focusing solely on operational disruption, the group's model centres on stealing large quantities of sensitive information and leveraging the reputational, regulatory and commercial consequences of disclosure to pressure organisations. This reflects a wider trend across the threat landscape, where data theft has become just as commercially lucrative for attackers as traditional ransomware."

"For retailers, the impact of an incident like this extends well beyond the immediate breach itself. The exposure of customer information can increase the risk of downstream fraud, phishing and identity-based attacks, while also eroding consumer trust in a sector where brand reputation is a critical differentiator. Once data has been exfiltrated, organisations face a prolonged period of incident response, regulatory engagement and customer reassurance."

"NCC Group's latest threat intelligence found that the consumer discretionary sector, which includes the likes of retailers and specialist brands, accounted for 18% of all attacks observed globally in July, demonstrating the continued focus cyber criminals place on the industry.”

“Against this backdrop, organisations must assume they will be targeted and prioritise resilience accordingly. That means strengthening identity and access controls, improving visibility across third-party environments, and ensuring they can rapidly detect, investigate and contain potential compromises before sensitive data can be removed from the network."

Speaker biography 

Matt Hull is Vice President of Cyber Intelligence and Response at NCC Group, leading the global Cyber Response and Intelligence (CRI) capability.   

A former Detective Constable specialising in cybercrime, Matt brings deep operational experience across investigation, response, and intelligence-led operations. He leads multidisciplinary teams supporting organisations through complex incidents, advanced threat activity, and the development of mature detection and response capabilities. 

Matt is recognised across the industry for his authenticity and clear communication, speaking at major conferences and featuring in media including BBC News, the Financial Times and Channel 4’s Hunted. He also serves as Chair of the Threat Intelligence Focus Group and sits on the CREST International Council.