Retail
41 organizations, 69 confirmed incidents.
Retail covers stores and e-commerce merchants holding customer order, loyalty and payment-card data. A retailer that extends its own store credit, by issuing a proprietary credit card for example, is itself a "financial institution" under the FTC's Safeguards Rule (16 CFR Part 314) and owes the same obligations as a non-bank lender; every retailer, regardless of that status, also reports a breach under the general state data-breach notification statute covering the customers affected, and exposed payment-card data separately triggers a PCI DSS notification to the card networks.
Incidents by year
| Year | Confirmed incidents |
|---|---|
| 2026 | 2 |
| 2025 | 7 |
| 2024 | 14 |
| 2023 | 15 |
| 2022 | 3 |
| 2021 | 4 |
| 2020 | 5 |
| 2019 | 5 |
| 2018 | 5 |
| 2017 | 3 |
| 2016 | 1 |
| 2015 | 4 |
| 2013 | 1 |
Top organizations by confirmed incidents
Questions and answers
How many confirmed incidents involve Retail organizations on Breach Census?
69 confirmed incidents across 41 organizations in the Retail sector are recorded on Breach Census.
Which year had the most confirmed Retail incidents?
2023, with 15 confirmed incidents, the most of any year on record for this sector.
Which attack types are most common in the Retail sector?
Among Retail sector incidents that carry an attack-type classification, the most common are Hacking/IT Incident, Ransomware Attack, Malware Deployment.
What counts as a confirmed incident for the Retail sector?
An incident counts here once its primary organization carries the Retail sector label and the incident itself has reached the confirmed status described on the Methodology page; a bare claim or press report is not enough.