PetEdge Cyberattack Highlights Retail Sector Vulnerabilities
Incident Date:
September 24, 2024
Overview
Title
PetEdge Cyberattack Highlights Retail Sector Vulnerabilities
Victim
PetEdge
Attacker
Play
Location
First Reported
September 24, 2024
Ransomware Attack on PetEdge: A Closer Look at the PLAY Ransomware Group's Latest Target
PetEdge, a prominent supplier in the pet care industry, has recently been targeted by a cyberattack orchestrated by the infamous PLAY ransomware group. This incident has sparked significant concern within the retail sector, especially among businesses specializing in pet products. Based in Beverly, Massachusetts, PetEdge is well-known for its extensive catalog of over 12,000 items, serving both pet care professionals and independent retailers. With a workforce of 100 to 250 employees and an estimated annual revenue of $50 million, PetEdge holds a substantial market presence.
Renowned for its dedication to quality and affordability, PetEdge has become a trusted partner for pet care professionals. The company provides a diverse array of products, including grooming equipment, pet apparel, toys, and grooming shampoos. Furthermore, PetEdge operates Boss PetEdge, a division that focuses on wholesale supplies for pet retailers, offering exclusive access to premium brands not found in large retail chains. This business model supports independent retailers by providing bulk pricing and enhancing profitability.
The PLAY ransomware group, active since June 2022, has taken responsibility for the attack on PetEdge. Known for targeting a wide range of industries, including IT, transportation, and government entities, the group has expanded its operations across North America, South America, and Europe. They employ sophisticated methods to infiltrate networks, often exploiting vulnerabilities in RDP servers, FortiOS, and Microsoft Exchange. Tools like Mimikatz are used for privilege escalation, and custom tools are employed to enumerate users and computers on compromised networks.
In PetEdge's case, the attackers have reportedly exfiltrated the company's database and announced plans to release the compromised data publicly. This incident underscores the vulnerabilities faced by companies in the retail sector, particularly those with extensive online operations. The PLAY ransomware group sets itself apart by not including an initial ransom demand in its notes, instead directing victims to contact them via email. This strategy, combined with their use of advanced tools and techniques, positions them as a formidable threat in the cybersecurity landscape.
Sources
Recent Ransomware Attacks
The Recent Ransomware Attacks (RRA) site acts as a watchtower, providing you with near real-time ransomware tracking of attacks, groups and their victims. Given threat actors’ overarching, lucrative success so far, ransomware attacks have become the most ubiquitous, and financially and informationally impactful cyber threat to businesses and organizations today.
The site’s data is generated based on hosting choices of real-world threat actors, and a handful of other trackers. While sanitization efforts have been taken, we cannot guarantee 100% accuracy of the data. Attack updates will be made as source data is reported by reputable sources. By viewing, accessing, or using RRA you acknowledge you are doing so at your own risk.