Citi Trends listed on Hunters International leak site

• Ransomware group: Hunters
• Country: United States
• Sector: Professional Services
• Announcement date: April 3, 2024

The Hunters International ransomware group has listed data allegedly belonging to Citi Trends on their leak site. The announcement, made on April 3, 2024, marks a new instance of a cyberattack targeting a major retail entity. While the group has claimed responsibility for the incident, the specific contents of the breach remain unverified by the victim organization.

Details of the claimed attack

According to the announcement posted on the group's leak site, the incident occurred on April 3, 2024. The Hunters International group claims to have successfully exfiltrated data from the organization. Notably, the group has stated that their activities during this specific operation did not involve the encryption of the organization's systems, focusing instead on the theft of information.

This approach is characteristic of modern cyber extortion tactics. In many contemporary ransomware operations, threat actors move away from traditional encryption-based attacks to focus on data exfiltration. By stealing sensitive information without locking systems, attackers can exert pressure on an organization through the threat of public exposure, a tactic often referred to as double extortion or pure extortion models.

The scope of the alleged data breach

The listing provided by the attackers includes specific metrics regarding the volume of the data they claim to have stolen. While the group has not provided specific details regarding the content of the allegedly exfiltrated data, the provided screenshots confirm the scale of the operation through the following metrics:

• Total data size: 520.7 GB
• Total file count: 442,754 files

The lack of specific information regarding the nature of the files—whether they contain financial records, employee details, or proprietary business information—is a common occurrence in early-stage leak site announcements. The group currently relies on the sheer volume of the data to demonstrate the impact of the breach.

About Citi Trends

Citi Trends is a United States-based retail chain that sells affordable clothing, footwear, accessories, and home goods. The company offers discounted products primarily catering to customers in urban areas. As a major player in the retail sector, the organization manages a vast amount of consumer and operational data.

Analysis and potential risks

Hunters International is a group that emerged in 2023 and is assessed to be derived from the Hive ransomware codebase. The exfiltration of organizational data may pose a risk of exposing employee or customer information. As the organization is based in the US, a potential data breach could trigger notification requirements under relevant state laws and federal regulations. Secondary risks include the potential for the leaked data to be used for identity theft or targeted phishing attacks.

It is worth noting that reports suggesting that the group ceased encryption activities as of 2025 may indicate that the group has shifted its strategy toward a model focused solely on data exfiltration and extortion. This shift highlights a growing trend in the cyber threat landscape where the primary goal is no longer system disruption, but the leverage provided by stolen information.

For organizations operating in the retail and professional services sectors, these types of threats necessitate robust defensive postures. Organizations can mitigate such risks by implementing strict data loss prevention (DLP) measures, maintaining comprehensive logging to detect unauthorized exfiltration, and ensuring that sensitive customer and employee data is encrypted at rest and in transit. Furthermore, adhering to regulatory compliance frameworks helps ensure that notification protocols are ready should a breach occur.