As expected, threat actors around the world do not pause for the holiday season. Shutterfly, a photography products and image sharing company headquartered in California, was recently hit by a ransomware attack conducted by the Conti ransomware threat group. Shutterfly has various brands, such as Shutterfly[.]com, Snapfish, Spoonflower, and TinyPrints, that were not affected by this attack. However, some of the company’s brands, including GrooveBook, Lifetouch, and BorrowLenses, as well as their corporate network did experience disrupted services. The ransomware attack occurred in approximately mid-December and Conti claims to have encrypted 120 VMware ESXi servers as well as 4,000 devices. No data has currently been published on Conti’s leak site, but it does contain screenshots of alleged stolen files. BleepingComputer reported that these files may include “legal agreements, bank and merchant account info, login credentials for corporate services, spreadsheets, and… customer information, including the last four digits of credit cards”. BleepingComputer also discussed that Conti claims to have the source code for “Shutterfly’s store”, but the extent of this claim is currently unclear. Shutterfly stated that “credit card, financial account information, or the Social Security numbers of our Shutterfly[.]com, Snapfish, Lifetouch, TinyPrints, BorrowLenses, or Spoonflower customers” are not stored and that the particular information was not impacted. Shutterfly’s investigation is ongoing, and CTIX analysts will provide updates when additional information is revealed.