99 Cents Only Stores

On Wednesday, the INC ransomware gang claimed to have attacked 99 Cents Only Stores, exfiltrating 1.2 terabytes of sensitive and personal data, including scans of passports. The company filed for bankruptcy last April and closed all of its stores in June 2024 due to financial hardship. Dollar Tree, which acquired some lease rights and assets from 99 Cents Only Stores, denied any involvement in the attack, stating that the data breach involved former 99 Cents Only employees.

Source: https://therecord.media/dollar-tree-discount-stolen-data

TPRM report: https://scoringcyber.rankiteo.com/company/99-cents-only-stores

"id": "99-252073125",
"linkid": "99-cents-only-stores",
"type": "Ransomware",
"date": "7/2025",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"

{'affected_entities': [{'industry': 'Retail',
                        'location': ['California',
                                     'Texas',
                                     'Arizona',
                                     'Nevada'],
                        'name': '99 Cents Only Stores',
                        'size': 'Nearly 400 stores at its peak',
                        'type': 'Retail'},
                       {'industry': 'Retail',
                        'location': ['United States', 'Canada'],
                        'name': 'Dollar Tree',
                        'size': '9,000 stores',
                        'type': 'Retail'}],
 'attack_vector': 'Data Exfiltration',
 'data_breach': {'data_exfiltration': '1.2 terabytes',
                 'personally_identifiable_information': 'Scans of passports',
                 'sensitivity_of_data': 'High',
                 'type_of_data_compromised': 'Scans of passports, Sensitive '
                                             'and personal data'},
 'date_detected': '2024-06',
 'date_publicly_disclosed': '2024-10-02',
 'description': 'Dollar Tree denies involvement in a ransomware attack claimed '
                'by the INC ransomware gang, which targeted 99 Cents Only '
                'Stores.',
 'impact': {'data_compromised': ['Scans of passports',
                                 'Sensitive and personal data']},
 'investigation_status': 'Ongoing',
 'motivation': 'Financial',
 'ransomware': {'data_exfiltration': '1.2 terabytes',
                'ransomware_strain': 'INC Ransomware'},
 'references': [{'date_accessed': '2024-10-02',
                 'source': 'Recorded Future News'},
                {'date_accessed': '2024-10-02',
                 'source': 'SentinelOne Research'}],
 'threat_actor': 'INC Ransomware Gang',
 'title': 'Ransomware Attack Claims Against Dollar Tree',
 'type': 'Ransomware Attack'}