Retail Recorded 837 Incidents and 419 Confirmed Breaches in a Quarter

Published industry figures record 837 cyber incidents in the retail sector during a single quarter of 2025, of which 419 were confirmed data breaches. Publicly disclosed ransomware attacks against retail rose 58% quarter on quarter, and the average cost of a retail data breach was put at $3.54 million.

837 incidents produced 419 confirmed breaches. The other 418 were incidents where data loss was not confirmed — a category that includes intrusions successfully stopped, intrusions where investigation was inconclusive, and intrusions where nothing was taken because the attack was aimed at availability instead.

Only the confirmed half generates a notification, a regulatory filing or a headline. The rest is the sector’s actual attack volume, visible here because a survey counted it and invisible everywhere else.

Note the wording: publicly disclosed ransomware rose 58%. That is a count of leak-site listings and public statements, and this desk has filed repeatedly on why that is not a count of attacks — see 26-0425 and 26-0512.

A quarter in which a high-profile campaign draws attention to a sector will produce more disclosure at any given level of attack. The 2025 retail campaign was exactly such a quarter. Some of that 58% is more attacks; some of it is the same attacks becoming visible.

$3.54 million is an average across a distribution with an enormous tail — a sector containing both a corner shop and a company reporting a nine-figure operational loss, as at 25-0430.

An average over that distribution is not a figure any individual retailer should plan against. It is useful for arguing that the cost is non-trivial and useless for estimating your own.