// UNCLASSIFIED // CLEARED FOR PUBLIC RELEASE //
FILE PUB-ENTDTG 0600Z
ColdRecon › Threat Groups › TheHatman
Threat Group Dossier

TheHatman

CLEARED FOR PUBLIC RELEASE · OPEN-SOURCE INTELLIGENCE
TheHatman — 8 attributed incidents across our corpus.
Incidents on file8
First seen2026-08-18
Last seen2026-08-27
Top sectorRetail

Techniques observed (MITRE ATT&CK)

T1078 Valid Accounts (5)T1195 Supply Chain Compromise (3)

Sectors targeted

Retail (3)

Attributed breaches

2026-08-27
supply chain
Pokémon Center
2026-08-26
supply chain
Pokémon Center
2026-08-25
supply chain
Pokémon Center
2026-08-22
stolen creds
McDonald's, Vodafone, Kyndryl & Others
2026-08-21
stolen creds
McDonald's, Vodafone, Kyndryl & Others
2026-08-20
stolen creds
McDonald's, Vodafone, Kyndryl & Others
2026-08-19
stolen creds
McDonald's, Vodafone, Kyndryl & Others
2026-08-18
stolen creds
McDonald's, Vodafone, Kyndryl & Others

Track this in real time.

ColdRecon watches the public signal so you don't have to — a daily brief and a live detection-coverage desk. Request clearance.

Request Clearance →