Over 123,000 users' data exposed in MarineMax data breach with Rhysida claiming responsibility

MarineMax, a major retailer of recreational boats and yachts with over 130 locations worldwide, is notifying over 123,000 customers and potentially employees about a data breach that occurred in March. The Florida-based company, which boasts over $2 billion in annual revenue, initially downplayed the incident, but later confirmed attackers accessed its systems and stole personal information.

The breach took place between March 1st and 10th, 2024. MarineMax acknowledges that stolen data includes names and personal identifiers, but hasn't specified the extent of the breach. The company is also yet to clarify if the compromised data belongs solely to customers, employees, or both.

While MarineMax hasn't confirmed the culprit, the Rhysida ransomware gang claimed responsibility for the attack in March. The group has since leaked a 225GB archive of allegedly stolen MarineMax data on their dark web leak site, including financial documents and what appear to be customer or employee identification documents.

This breach is just one example - 2024 has been a playground for hackers so far. Rhysida, active since May 2023, has since targeted organizations across various sectors, including healthcare and government institutions. It's the same group responsible for the Insomniac hack where the future roadmap of the company's releases was leaked. Only a few days ago, AT&T was subject to a data breach, and before that, 33 million users were affected in an Authy breach - highlighting just how seriously privacy needs to be taken these days.