Belk Vendor Cyber Rating & Cyber Score

DragonForce Ransomware Group Strikes US Retailer Belk in Major Cyberattack

**DragonForce Ransomware Group Strikes US Retailer Belk in Major Cyberattack** The US department store chain **Belk** has fallen victim to a cyberattack by the **DragonForce ransomware group**, the same threat actor behind the recent **£300 million ($403 million) attack on UK retailer Marks & Spencer (M&S)**. The breach, disclosed in early June via a filing with the **New Hampshire Attorney General’s Office**, involved unauthorized access to corporate systems and sensitive customer data. Researchers from **Cybernews** confirmed the legitimacy of the leak, which includes **names, dates of birth, addresses, phone numbers, email addresses, and order histories** data that could be exploited by malicious actors, data brokers, or insurance companies for profiling. The exposed information also encompasses **store coupons, employee records, and data from Belk’s mobile app infrastructure**. While the exact number of affected individuals remains unclear, estimates suggest **up to a million users** may be impacted, though some accounts are likely test profiles. DragonForce, which first emerged in **2023**, has rapidly expanded its operations, targeting **104 organizations in the past year**. The group operates a **dark web blog** where it lists victims and shares stolen data. In Belk’s case, attackers claim to have exfiltrated **156GB of company data**, including backups and employee profiles. The gang initially stated it had no intention of "destroying" Belk’s business but resorted to destructive measures after the company refused to pay the ransom. The attack has had **significant financial repercussions** for M&S, forcing its online clothing operations offline, disrupting food supply chains, and wiping **over £1 billion from its stock market value**. Online sales and trading profits in the affected division have been "heavily impacted" due to the suspension of e-commerce services. Belk, founded in **1888**, operates nearly **300 stores across 16 US states** and reported **$4 billion in revenue last year**. The incident underscores the growing threat posed by ransomware groups like DragonForce, which has also **hijacked infrastructure from rival gangs** such as **BlackLock, Mamona, and RansomHub** in a bid to dominate the cybercriminal landscape.