360 InStore Listed by avaddon Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On September 9, 2021, the ransomware group Avaddon listed 360 InStore on its data-leak site. The listing stated that internal files had been taken during a ransomware operation. No figure for the number of individuals affected has been released, and the company has not confirmed the claims or disclosed further details. Ransomware groups have increasingly adopted a tactic of publishing victim names and sample data on dedicated sites when ransom demands are not met. This incident fits that pattern, though the scale and contents remain unverified.

Inside the incident

The only confirmed public record is the September 9, 2021 listing on Avaddon’s leak site. The group claims to have exfiltrated internal files. No information has been made public about the date of the intrusion, the method of access, the volume of data, or whether any data was subsequently published. The number of people potentially affected is also undisclosed.

The group behind it: avaddon

Avaddon operated as a ransomware-as-a-service group between 2020 and 2021. Its standard approach combined file encryption with the threat of data publication on a dedicated leak site. The group targeted organisations across multiple sectors and relied on affiliates to conduct intrusions. Its infrastructure was later disrupted by law-enforcement action in 2021.

Who is 360 InStore?

360 InStore provides technology and services to retail and in-store environments. Organisations of this type routinely manage point-of-sale systems, inventory records, supplier information and employee data. A compromise of internal systems can therefore affect both operational continuity and the personal information of customers and staff.

What data was at risk

The listing refers only to “internal files.” No inventory of specific data categories has been released. Organisations in this sector commonly hold customer transaction records, payment details, employee records and commercial contracts, but it is not confirmed whether any of these categories were among the exfiltrated material.

Why it matters

Internal files can contain information that enables further targeting of individuals or the organisation itself. Where personal data is involved, affected people may face risks of identity misuse or fraud. For the company, the incident adds to the operational costs of investigation, potential regulatory scrutiny and the need to strengthen access controls.

Were you affected?

Public information does not identify specific individuals. Anyone concerned can take the following steps:

• Monitor bank and credit accounts for unusual activity.
• Change passwords for any accounts linked to retail or service providers.
• Enable multi-factor authentication on email and financial services.
• Run a free exposure scan of your email address against known breach data.

AICompiled with AI assistance from public sources and published under our editorial standards.