MediaMarkt

MediaMarkt, a leading European electronics retailer with over 1,000 stores across 13 countries and 53,000+ employees, fell victim to a Hive ransomware attack. The cyberattack disrupted operations by forcing affected outlets—spanning the Netherlands, Germany, Luxembourg, Belgium, Austria, and Switzerland—to disable payment terminals, halting transactions and causing significant business continuity disruptions. The attackers initially demanded a $240 million ransom in Bitcoin, later negotiating to $50 million. The incident highlights the severe financial and operational risks posed by ransomware, particularly for high-revenue targets like MediaMarkt, which reported over €20 billion in annual revenue. While the full scope of data compromise remains undisclosed, the attack’s immediate impact included payment system outages, likely leading to lost sales, reputational damage, and potential long-term customer distrust. The use of Hive ransomware—a sophisticated strain known for double extortion (data encryption + theft)—suggests the attackers may have exfiltrated sensitive corporate or customer data, compounding the threat of regulatory penalties and litigation.

Source: https://www.acronis.com/en/tru/posts/mediamarkt-hit-by-hive-ransomware/

TPRM report: https://www.rankiteo.com/company/mediamarkt-benelux

"id": "med5764157090625",
"linkid": "mediamarkt-benelux",
"type": "Ransomware",
"date": "5/2025",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization’s existence"

{'affected_entities': [{'industry': 'electronics',
                        'location': ['Netherlands',
                                     'Germany',
                                     'Luxembourg',
                                     'Belgium',
                                     'Austria',
                                     'Switzerland'],
                        'name': 'MediaMarkt',
                        'size': 'Over 1,000 shops across 13 European '
                                'countries; 53,000+ employees',
                        'type': 'retailer'},
                       {'industry': 'electronics',
                        'location': ['Netherlands',
                                     'Germany',
                                     'Luxembourg',
                                     'Belgium',
                                     'Austria',
                                     'Switzerland'],
                        'name': 'Saturn',
                        'type': 'retailer'}],
 'data_breach': {'data_encryption': True},
 'description': 'The electronics retailer MediaMarkt and some of the Saturn '
                'stores were targeted by Hive ransomware, forcing affected '
                'outlets to disable payment terminals. The attack impacted '
                'stores in multiple European countries, including the '
                'Netherlands, Germany, Luxembourg, Belgium, Austria, and '
                'Switzerland.',
 'impact': {'brand_reputation_impact': 'Potential reputational damage due to '
                                       'high-profile attack',
            'downtime': True,
            'operational_impact': 'Payment systems disabled in affected stores',
            'payment_information_risk': 'Possible (payment terminals disabled '
                                        'as precaution)',
            'systems_affected': ['payment terminals']},
 'initial_access_broker': {'high_value_targets': ['payment systems',
                                                  'customer data (potential)']},
 'motivation': ['financial gain', 'extortion'],
 'ransomware': {'data_encryption': True,
                'ransom_demanded': ['$240 million (initial)',
                                    '$50 million (negotiated)'],
                'ransomware_strain': 'Hive'},
 'references': [{'source': 'Acronis Cyber Protect'}],
 'response': {'containment_measures': ['disabling payment terminals']},
 'threat_actor': 'Hive ransomware group',
 'title': 'MediaMarkt and Saturn Stores Hit by Hive Ransomware',
 'type': ['ransomware', 'cyberattack']}