In October 2024, cybersecurity researchers made a discovery that would ripple across the retail industry: a massive trove of sensitive customer data—nearly 57 million records linked to Hot Topic—was found for sale on an illicit forum. But this wasn’t just a one-brand incident. As investigators dug deeper, it became clear that the breach stretched further, implicating Torrid and BoxLunch, and possibly compromising up to 350 million records in total.

Names, phone numbers, email addresses, loyalty points, and even fragments of payment card information were leaked. This is now being called one of the largest retail data breaches in history.

The attackers, a group calling themselves Satanic, used a type of malware known as an infostealer to harvest login credentials from a single developer’s machine. Once inside, they slipped through the network unchecked—no multi-factor authentication (MFA) stood in their way. What followed was textbook double extortion ransomware: encryption of data, demands for money, and threats to leak.

But here’s the truth: this wasn’t just a failure of technology. It was a breakdown in risk management, communication, and business continuity. And if it can happen to multi-million-dollar retailers, it can happen to anyone.

So, what should your business take away from this breach? What steps can you take now to avoid the same fate?

 

What Really Happened in the Hot Topic Breach?

Cybersecurity experts revealed that the breach impacted Hot Topic, Torrid, and BoxLunch, compromising up to 350 million records. Exposed data included:

  • Names and addresses
  • Email addresses and usernames
  • Phone numbers and loyalty points
  • Partial credit card data (e.g., last 4 digits)

The attack originated from infostealer malware that captured a developer’s credentials, ultimately granting attackers access to a third-party data platform (Snowflake). Most alarmingly, the affected companies did not have multi-factor authentication (MFA) in place to stop the intrusion.

This breach is now considered one of the largest in retail history.

 

Why SMBs Should Be Paying Attention

 

You might think an attack like this only happens to well-known brands. But that assumption is dangerous.

Larger retailers often have dedicated cybersecurity teams, compliance officers, and defined processes—and even they get breached. Smaller businesses may have fewer resources, but they also have fewer layers of defense. That makes them attractive targets.

Tim Derrickson, CISSP and Director of IT & Security Services at One Step Secure IT, explains: “The truth is, many SMBs believe they’re prepared simply because they have an internal or outsourced IT team. But having IT support doesn’t automatically mean you’re cyber-ready. True protection requires staying ahead of threats with the right policies, layered defenses, and a proactive cybersecurity strategy.”

Even if you can't prevent every threat, you can significantly minimize damage with the right approach. Here’s how:

1. Have a Documented Incident Response Plan

Your team should know exactly what to do in the event of an attack. Don't write it once and forget it—test it regularly and update it as your business evolves. The plan should include procedures for handling different types of incidents, as well as contact information for the individuals who should be notified in the event of an attack. Explore reasons why every business owner needs an Incident Response Plan.

2. Follow Compliance Frameworks, Even If Not Required

Whether it’s PCI DSS, HIPAA, or NIST CSF 2.0, having a framework in place gives structure to your security strategy—even if you aren’t technically required to follow it.

Ensuring compliance with industry standards and regulations is paramount for business owners. Compliance protects you from legal repercussions, safeguards your operations, and upholds your reputation. Understand the risks of non-compliance.

3. Adopt a Layered Security Approach

From endpoint detection and response (EDR) to backup validation and secure application controls, no single tool is enough. Every layer matters. Consider:

  • Network segmentation
  • Employee security training
  • Managed detection and response (MDR)
  • Application whitelisting

 

New Threat Unlocked: Double Extortion

In this podcast episode, Tim Derrickson uncovers a new cyber fear; Double extortion ransomware attacks. He explains that in a traditional ransomware attack, hackers encrypt your files and demand payment to unlock them. But in a double extortion scenario, the threat doesn’t stop there.

“Here’s what happens: you decide to pay the ransom, and they send you the decryption keys. You think you’re in the clear—your data’s unlocked, and operations can resume. But then they hit you again and say, ‘Guess what? We still have all your data.”—Tim Derrickson

 


 

What Happens During a Double Extortion Attack?

Attackers first infiltrate a victim's network, exfiltrate sensitive data, and then encrypt it. The ransom demand comes in two parts:

  1. Pay to decrypt your data.
  2. Pay again to prevent your stolen data from being leaked or sold on the dark web.

Even if the ransom is paid, there's no guarantee the data won't be exposed later. Victims face reputational harm, legal liability, and lasting damage.

Tim Derrickson explains it plainly: “Even after you pay the ransom and regain access to your systems, the threat may not be over. Attackers will often say, ‘We still have your data—HR records, financials, client lists—and unless you pay again, we’ll leak it, send it to your clients, or sell it on the dark web.’ And here’s the catch—even if the original group honors the deal, the data could’ve already been downloaded by others. That’s when the second wave of extortion begins.”

 

How Do Attackers Gain Access?

In many double extortion cases, initial access is gained through:

  • Phishing emails with malicious links or attachments
  • Infostealer malware that logs keystrokes and steals credentials
  • Poor password hygiene or lack of multi-factor authentication
  • Vulnerabilities in third-party software or services

Once inside, attackers perform reconnaissance to identify high-value data, then move laterally across systems—often undetected for weeks.

 

How to Prevent Double Extortion Ransomware Attacks

While no strategy is foolproof, these practices significantly reduce your exposure:

  • Enforce MFA everywhere, especially for remote access and privileged accounts
  • Use endpoint detection and response (EDR) tools to identify threats early
  • Back up critical systems regularly and test your recovery process
  • Adopt a Zero Trust approach: verify every user, device, and connection
  • Educate employees on phishing and social engineering tactics
  • Deploy data loss prevention (DLP) tools to detect suspicious data transfers

Preparation is the best defense. Businesses that combine proactive monitoring, strong access controls, and incident response planning are far more likely to contain the impact—and avoid paying twice.

Hackers aren’t just encrypting your files. They’re stealing your data and threatening to leak it publicly unless you pay again. This double extortion tactic is becoming more common and more damaging—especially if sensitive customer or HR data is involved.

 

Final Thought: Don’t Wait for a Crisis to Take Action

If a breach can happen to brands with massive IT and cybersecurity budgets, it can happen to anyone. But it doesn’t have to be devastating.

With the right risk management mindset, layered defenses, and a clear response plan, you can reduce the impact, preserve trust, and protect your business.

Related Resources:

Tune in to the One Step Beyond Cyber Podcast on:

BuzzSprouts | Spotify | Apple Podcast | Amazon Music | YouTube