Fashion House Louis Vuitton Confirms Breach

Every week, ISMG rounds up cybersecurity incidents and breaches around the world. This week: Louis Vuitton and Co-op confirm breach, unpatched train brake flaw, Barclays fined £42M for financial crime failures, secret U.K. program relocated thousands of Afghans, ex-soldier pleads guilty to hacking, Ukrainian hackers claim hit on Russian drone supplier.

See Also: On Demand | From Patch to Prevention: Modernizing Remediation Across Hybrid Environments

Louis Vuitton confirmed data breaches at its stores in Turkey, South Korea and the United Kingdom, exposing customer information. Turkey’s Personal Data Protection Board said the breach began on June 7 and was discovered on July 2. Hackers accessed a third-party provider’s database through a compromised service account, affecting nearly 143,000 customers in Turkey.

While specific data details weren’t disclosed there, Louis Vuitton South Korea said names and contact information were leaked, but not financial data. The U.K. branch also reported a breach last week, with investigations ongoing. It remains unclear if the incidents are linked. Louis Vuitton urged customers to be wary of suspicious messages and is conducting internal reviews. The breaches come amid a wider cyber campaign targeting luxury and retail brands. Other LVMH brands including Dior and Tiffany, along with retailers Adidas and Victoria’s Secret, have recently reported similar incidents.

Cybersecurity and Infrastructure Security Agency issued an alert about a critical flaw, CVE-2025-1727, in the radio protocol connecting End-of-Train and Head-of-Train systems. Used in freight trains, EoT devices wirelessly relay telemetry and receive brake commands – but lack encryption or authentication.

Researchers Neil Smith and Eric Reuter found attackers could use software-defined radios to forge packets and issue unauthorized brake commands, risking derailments or service disruptions. Smith discovered the issue in 2012, but warnings were dismissed by the American Association of Railroads, which claimed the system was obsolete – even as it remains in use.

The radio protocol, dating back to the 1980s, relies on a simple BCH checksum and was assumed secure due to FCC regulations. Under renewed pressure, the AAR now plans to replace it with IEEE 802.16t by 2027. CISA says there’s no evidence of exploitation, but the vulnerability remains active and dangerous.

British consumer co-operative Co-op CEO Shirine Khoury-Haq confirmed that all 6.5 million members had their personal data – including names, addresses and contact details – stolen in a cyberattack in April. Khoury-Haq expressed regret but said that no financial data was compromised.

The attack, also affecting M&S and Harrods, prompted Co-op to cut internet access to prevent ransomware deployment. Police arrested four people – ages 17 to 20 – last week on suspicion of cybercrime, blackmail and money laundering, but have since been released on bail. Authorities seized electronic devices as part of the investigation.

Co-op is still restoring systems and has not disclosed the financial impact. It has partnered with The Hacking Games to offer cybersecurity career paths for youth, launching a pilot program with Co-op Academies Trust to steer talent away from cybercrime.

The U.K.’s Financial Conduct Authority fined Barclays £42 million for serious failings in managing financial crime risks linked to two businesses – Stunt & Co and WealthTek.

Authorities fined Barclays £39.3 million for failing to adequately assess and monitor money laundering risks when providing services to Stunt & Co, run by socialite James Stunt. Despite receiving daily cash deposits of up to two million pounds and warnings from police about associated raids, the bank continued treating the firm as low risk. Stunt & Co received £46.8 million from Fowler Oldfield, a Bradford-based gold dealer tied to a major money laundering scheme.

Barclays voluntarily paid £6.3 million to affected clients and got a reduced fine for early settlement and cooperation.

The U.K. government used an unprecedented super injunction to suppress a major data breach involving 18,700 Afghans who had applied to relocate under British resettlement schemes. The breach, caused by a Ministry of Defence error in 2022, was discovered in August 2023 after data was posted in a Facebook group. Fearing Taliban reprisals, ministers sought and obtained a “contra mundum” injunction to prevent any reporting.

The breach led to the creation of the Afghanistan Response Route, a secret scheme that would have resettled up to 15,000 people at a projected cost of over two billion pounds. The injunction, lifted this week by the high court, concealed the program’s existence and cost from public and parliamentary scrutiny.

Defence Secretary John Healey apologized and criticized the lack of transparency. The Labour government has since cancelled the ARR, which had already cost £400 million, though 1,800 Afghans with existing offers will still be relocated.

Court records revealed that the leaked spreadsheet contained personal details of Afghan allies, MPs and U.K. officials. Affected individuals may pursue legal action. The ARR was one of three schemes aiding Afghan resettlement since the 2021 Taliban takeover, with total costs now projected between £5.5 million and £6 billion.

The U.S. Department of Justice announced that 21-year-old former soldier Cameron John Wagenius pleaded guilty to hacking and extortion charges while serving in the military. Using the alias “kiberphan0m,” Wagenius conspired with others to hack into at least 10 telecommunications firms, steal sensitive data using a brute-force tool called SSH Brute and extort victims by threatening to leak the stolen data unless ransoms were paid.

The stolen data was offered for sale on cybercrime forums and was linked to additional cases of fraud, including SIM-swapping attacks. The group tried to extract more than a million in funds through their campaign. Wagenius admitted to extortion, conspiracy to commit wire fraud and aggravated identity theft, in addition to earlier guilty pleas involving the unlawful transfer of confidential phone records.

Authorities have also linked Wagenius to the Snowflake breach, which affected hundreds of companies. That attack was financially motivated and conducted using a credential-stuffing method.

Ukrainian hackers from the Black Owl team, alongside the Ukrainian Cyber Alliance and an unnamed “well-known organization,” claimed to have crippled the IT infrastructure of Russia’s Gaskar Integration plant – one of its largest drone manufacturers. Hackers alleged that China was helping train Gaskar personnel.

In a Telegram post, the hackers said they infiltrated Gaskar’s systems and destroyed 47TB of sensitive data, including 10TB of backups, related to current and future drone production. They also claimed to have stolen all source code and confidential employee files before wiping the servers entirely.

The attack reportedly disabled Gaskar’s entire network so thoroughly that even the building’s doors locked, forcing staff to trigger the fire alarm to exit. The hackers said this could jeopardize Russia’s defense orders and delay thousands of drones from reaching the front lines.

BO Team hinted at involvement by Ukraine’s military intelligence agency. Neither Gaskar nor Ukraine’s Ministry of Defence commented on the claims. The hackers described their operation as a deep blow to Russian military capacity and mockingly referenced Russia’s own propaganda terms of “denazification” and “demilitarization.”

A joint investigation by Italian, French, Romanian authorities and Europol led to the arrest of a 44-year-old Romanian man in Milan, believed to be the leader of the ransomware group Diskstation. The gang targeted medical, legal and business offices in Northern Italy, launching at least 42 attacks and demanding ransoms in cryptocurrency. The suspect managed both the tech and laundering side of operations, authorities said. Police traced crypto transactions, seized encrypted devices and conducted wiretaps to identify him. Investigations continue to track down accomplices and financial flows linked to the group.

Other Stories From Last Week

With reporting from Information Security Media Group’s Gregory Sirico in New Jersey.