Privacy Ninja



        • Secure your network against various threat points. VA starts at only S$1,000, while VAPT starts at S$4,000. With Price Beat Guarantee!

        • API Penetration Testing
        • Enhance your digital security posture with our approach that identifies and addresses vulnerabilities within your API framework, ensuring robust protection against cyber threats targeting your digital interfaces.

        • On-Prem & Cloud Network Penetration Testing
        • Boost your network’s resilience with our assessment that uncovers security gaps, so you can strengthen your defences against sophisticated cyber threats targeting your network

        • Web Penetration Testing
        • Fortify your web presence with our specialised web app penetration testing service, designed to uncover and address vulnerabilities, ensuring your website stands resilient against online threats

        • Mobile Penetration Testing
        • Strengthen your mobile ecosystem’s resilience with our in-depth penetration testing service. From applications to underlying systems, we meticulously probe for vulnerabilities

        • Cyber Hygiene Training
        • Empower your team with essential cybersecurity knowledge, covering the latest vulnerabilities, best practices, and proactive defence strategies

        • Thick Client Penetration Testing
        • Elevate your application’s security with our thorough thick client penetration testing service. From standalone desktop applications to complex client-server systems, we meticulously probe for vulnerabilities to fortify your software against potential cyber threats.

        • Source Code Review
        • Ensure the integrity and security of your codebase with our comprehensive service, meticulously analysing code quality, identifying vulnerabilities, and optimising performance for various types of applications, scripts, plugins, and more

        • Email Spoofing Prevention
        • Check if your organisation’s email is vulnerable to hackers and put a stop to it. Receive your free test today!

        • Email Phishing Excercise
        • Strengthen your defense against email threats via simulated attacks that test and educate your team on spotting malicious emails, reducing breach risks and boosting security.

        • Cyber Essentials Bundle
        • Equip your organisation with essential cyber protection through our packages, featuring quarterly breached accounts monitoring, email phishing campaigns, cyber hygiene training, and more. LAUNCHING SOON.

Fashion retailer Guess discloses data breach after ransomware attack

Fashion retailer Guess discloses data breach after ransomware attack

American fashion brand and retailer Guess is notifying affected customers of a data breach following a February ransomware attack that led to data theft.

“A cybersecurity forensic firm was engaged to assist with the investigation and identified unauthorized access to Guess’ systems between February 2, 2021 and February 23, 2021,” the company said in breach notification letters mailed to impacted customers.

“On May 26, 2021, the investigation determined that personal information related to certain individuals may have been accessed or acquired by an unauthorized actor.”

Guess directly operates 1,041 retail stores in the Americas, Europe, and Asia, and its distributors and partners another 539 additional stores worldwide as of May 2021. The stores part of Guess’ retail network currently operate in roughly 100 countries around the world.

Also Read: How Does Ransomware Work? Examples and Defense Tips

Personal and financial info stolen in the attack

The fashion retailer identified the addresses of all impacted individuals after completing a full review of the documents stored on breached systems on June 3, 2021.

Guess began mailing breach notification letters to affected customers on June 9, offering complimentary identity theft protection services and one year of free credit monitoring through Experian to all impacted individuals.

According to the breach notifications mailed on Friday, information exposed in the attack includes personal and fin

“On May 26, 2021, the investigation determined that personal information related to certain individuals may have been accessed or acquired by an unauthorized actor,” Guess said.

“The investigation determined that Social Security numbers, driver’s license numbers, passport numbers and/or financial account numbers may have been accessed or acquired.”

While the breach notification letters do not reveal the number of affected individuals, information filed with the office of Maine’s Attorney General shows that just over 1,300 people had their data exposed or accessed during the February attack.

The filed breach info also reveals that the information acquired during the incident includes “Financial Account Number or Credit/Debit Card Number (in combination with security code, access code, password or PIN for the account).”

Guess has implemented additional measures to boost its security protocols and is cooperating with law enforcement as part of an ongoing incident investigation.

DarkSide ransomware likely behind the attack

Even though Guess did not provide any info on the identity of the threat actor behind the ransomware attack, reported in April that the DarkSide ransomware gang listed Guess on their data leak site.

At the time, the ransomware group claimed to have stolen over 200 GB worth of files from the fashion retailer’s network before attempting to encrypt their systems.

DarkSide has been active since at least August 2020, focusing on corporate networks and asking millions of dollars for decryptors and the promise not to leak the stolen data online.

The ransomware gang landed in the crosshairs of US law enforcement after taking down Colonial Pipeline, the largest fuel pipeline in the US, in May.

After heightened scrutiny from law enforcement and having some of their infrastructure seized or brought down, DarkSide suddenly shut down in late May, allegedly out of fear of being arrested.

Update: When asked to confirm the identity of the threat actors behind the incident, Guess’ Director of Public Relations Kaitlyn Quail sent BleepingComputer the following statement after the article was published:

Guess?, Inc. recently concluded an investigation into a security incident that involved unauthorized access to certain systems on Guess?, Inc.’s network. We engaged independent cybersecurity firms to assist in the investigation, notified law enforcement, notified the subset of employees and contractors whose information was involved and took steps to enhance the security of our systems. The investigation determined that no customer payment card information was involved.  This incident did not have a material impact on our operations or financial results.

Dealing with a Ransomware? Also Read: 5 Most Frequently Asked Questions About Ransomware



Subscribe to our mailing list to get free tips on Data Protection and Data Privacy updates weekly!

Personal Data Protection


We have assisted numerous companies to prepare proper and accurate reports to PDPC to minimise financial penalties.


Click one of our contacts below to chat on WhatsApp

× Chat with us