Cyber Incident Victim: Intersport
Date:
Dec 2020
Location:
Slovenia
Summary
The international sporting goods retailer experienced two distinct cyberattacks within a short timeframe, first compromising customer data through Magecart skimming code deployed across its online platforms in Slovenia, Croatia, Serbia, Bosnia and Herzegovina, and Montenegro. Subsequently, Conti ransomware operators targeted the organization, exfiltrating data and publicly leaking over two dozen files as evidence of network access, though the company did not publicly acknowledge the ransomware incident despite media inquiries. These breaches collectively exposed sensitive customer information and operational data through different attack vectors.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
In 2020, Intersport, an international sporting goods retailer, experienced two distinct cyberattacks. The first incident, reported in June, involved a Magecart attack targeting Intersport’s e-commerce websites in Slovenia, Croatia, Serbia, Bosnia and Hercegovina, and Montenegro. Magecart attacks typically involve the injection of malicious code into online payment pages to steal customer payment data, though the article does not specify the exact data compromised in this case. Approximately six months later, on or around December 2, 2020, Intersport faced a second cyberattack attributed to the Conti ransomware group. Conti threat actors claimed to have exfiltrated data from Intersport’s systems and dumped more than two dozen files online as alleged proof of their access. The group’s involvement suggested a ransomware operation, which often combines data theft with encryption of victim systems to extort payments. DataBreaches.net contacted Intersport for comment on the December incident but received no response by the time of publication.
The Conti attack represented an escalation in tactics compared to the earlier Magecart incident, shifting from stealthy payment card skimming to a disruptive ransomware operation with public data leaks. While the article does not detail the specific types of data exfiltrated in the December attack, Conti’s history of targeting corporate networks implied potential exposure of internal business documents, employee information, or customer records. Intersport’s lack of public acknowledgment or response to the Conti incident, as noted in the article, left the full scope of operational disruption, financial impact, and remediation efforts unconfirmed. The two attacks collectively highlighted persistent vulnerabilities in Intersport’s digital infrastructure across multiple regional subsidiaries and underscored the evolving threats faced by retail organizations, from payment fraud to double-extortion ransomware campaigns.