In January 2021, clothing retailer FatFace was hit by a ransomware attack attributed to the Conti cybercrime group. The company disclosed the incident to customers and staff in March 2021 and said it paid a $2 million ransom to regain access to encrypted data. The supplied source does not establish whether customer data was exfiltrated, so the incident should not be described as a confirmed data breach beyond the reported encryption and ransom payment.
The attack exposed the operational and financial leverage that ransomware groups can exert over retailers dependent on digital systems. FatFace was already undergoing a lender-led restructuring completed in September 2020, which reduced borrowings from a stated face value of £172.4 million to £25.6 million at the period end. The source identifies no fines, prosecutions, regulatory enforcement, or confirmed lasting legal consequences from the ransomware incident, but the disclosure made the ransom payment and Conti’s role public.