Unwrapping Retail Peak Season Cyber Threats
Unit 42 explores key peak shopping season retail cyber threats, from ransomware to AI attacks, and shares how to defend operations and customer trust.
Introduction
During the 2025 peak holiday shopping season, the National Retail Federation predicted that retail sales would surpass $1 trillion USD for the first time, with Salesforce later reporting that online sales equated to $1.3 trillion globally. This included $294 billion in the United States and $262 billion influenced by AI and agents. Cybercriminals are highly aware that the holiday season is generally the most profitable for retailers, and look to capitalize on it for their own financial gain.
This blog explores the main cyber threats that retail organizations need to be aware of and prepared to defend against as we approach peak shopping season in 2026. We highlight notable security events that occurred in prior years during this time period. We also examine relevant threats from both an enterprise and guest point of view and provide examples of the evolving trend of autonomous attacks that could impact retailers.
Background
Since 2020, there have been several notable security events disclosed toward the end of peak shopping season. This includes the SolarWinds software supply chain compromise in December 2020 and the exploitation of a Log4j zero-day vulnerability in December 2021. Both events posed complexities for retail security teams as they occurred during a period where code freezes were likely in place. This limited the ability for organizations to make changes to critical technology systems to prevent any operational disruption to core technology infrastructure.
In addition to these broader threat landscape events, retailers typically face an increase in many types of financially-motivated attacks during this time period. This includes tactics and techniques designed to target both enterprises and guests alike.
Based on years of previous activity against Fortune 100 retailers from cyber threats during peak shopping season, these are the types of attacks that retailers should be primarily focused on detecting and responding to this time of year.
Enterprise-Focused Threats
Ransomware
Ransomware continues to pose a major risk for retail organizations heading into peak shopping season due to potential for operational disruption that could negatively impact the guest experience (in-store and online) and supply chain requirements (inventory).
As of Sept. 30, 2026, ransomware operators have claimed 565 retail organizations as victims this year, with the median company revenue hovering around $22 million. The top three ransomware operators that claimed retail victims are TGR-CRI-1173 (aka The Gentlemen), Spikey Scorpius (aka Qilin) and Howling Scorpius (aka Akira).
One example of a ransomware incident that impacted a retailer during peak shopping season occurred in December 2023, when Ambitious Scorpius (aka ALPHV) stole millions of customer records from a victim and caused significant operational disruption in terms of delayed order fulfillment, canceled e-commerce orders and slowed inventory replenishment.
To mitigate ransomware risks that jeopardize uptime, retailers need to deploy automated containment mechanisms alongside robust network segmentation strategies. Security teams should:
- Leverage advanced endpoint protection featuring real-time behavioral analysis to rapidly isolate compromised assets
- Enforce zero trust access across the enterprise to limit lateral movement
- Utilize inline sandboxing capabilities to inspect suspicious binaries and stop zero-day exploits before execution
Data Theft and Extortion
Data theft and extortion attacks continue to rise in volume as cybercriminals like Bling Libra (aka ShinyHunters) and Hazy Scorpius (aka CL0P) forgo ransomware to accelerate their attack lifecycles without compromising their actions on objectives.
The 2026 Unit 42 Global Incident Response Report found that extortion incidents without the use of encryption (78%) in 2025 dropped below the 90% range for the first time in several years. Consumers put a lot of trust in retailers safeguarding their personal data, and such extortion incidents this time of year severely damage it.
One notable example occurred in December 2021, when Bling Libra stole hundreds of gigabytes of data from a victim. This included customer email addresses, hashed passwords, customer payment invoices and internal employee files containing salaries and tax IDs.
To mitigate data theft and extortion risks threatening customer personal information and transactional records, organizations must deploy comprehensive enterprise data loss prevention (DLP) controls across their enterprise environments to identify and restrict illicit data exfiltration. Security teams should combine DLP capabilities with continuous attack surface management (ASM) to identify and remediate publicly accessible systems, while implementing zero trust access to strictly limit access privileges based on the principle of least privilege.
Distributed Denial of Service (DDoS)
DDoS also poses a major risk for retailers during peak shopping season because these attacks severely impact the operational uptime for e-commerce platforms if successful.
During the December 2025 holiday rush, the pro-Russian hacktivist group Noname057(16) used the DDoSia botnet to launch coordinated TCP SYN and HTTP GET request floods targeting the victim’s web-facing portals and API endpoints. This DDoS attack knocked its central systems offline, paralyzed package tracking tools, disrupted e-commerce merchant payment services and delayed parcel processing across their retail distribution networks.
To mitigate DDoS risks threatening e-commerce and payment processing platforms, organizations must combine inline application-layer protections. Security teams should:
- Deploy dynamic rate-limiting controls to protect against web site request floods
- Implement automated mitigation to filter malicious connections
- Utilize distributed edge networks to absorb large-scale traffic spikes before impacting critical systems
Digital Skimming
Although carding shops are not as prevalent as they were in prior years, digital skimming continues to be a popular technique used by cybercriminals to steal and monetize payment card information.
One example of a digital skimming incident that impacted retailers during peak shopping season occurred in October 2024, when unspecified threat actors exploited the CosmicSting vulnerability (CVE-2024-34102) to execute remote code on unpatched servers. This led to the installation of persistent backdoors and the injection of payment skimming scripts into checkout flows, affecting roughly 5% of all online stores running on prominent e-commerce platforms worldwide leading into Black Friday and Cyber Monday.
To mitigate digital skimming risks threatening payment processing workflows, organizations must implement web application and API protection (WAAP) solutions to monitor web traffic, intercept remote code execution attempts and prevent unauthorized client-side script manipulation. Security teams should:
- Leverage cloud security posture management (CSPM) alongside application security posture management (ASPM) to continuously identify server vulnerabilities
- Remediate unpatched flaws
- Correct security configuration drift prior to holiday code freezes
Guest-Focused Threats
Account Takeover
Credential stuffing attacks are a major concern for retailers during peak shopping season as they directly impact the trust of their customers if an account is compromised. This is even more damaging if the customer has payment card information saved in their account.
One key example occurred in December 2022, when unspecified threat actors used automated scripts targeting the victim’s mobile app and web login APIs. They used large databases of stolen credentials to conduct the attack, which ultimately led to the compromise of thousands of loyalty accounts. The actors were able to drain stored gift card balances, steal mobile payment funds and collect rewards points before advertising access to the compromised accounts on dark web forums.
To mitigate account takeover risks threatening mobile applications and authentication APIs, organizations must implement WAAP solutions with advanced bot mitigation capabilities to effectively distinguish credential stuffing campaigns from legitimate customer access without friction. Security teams should complement this by deploying advanced security to identify and block traffic attempting to communicate with malicious command-and-control (C2) infrastructure used to orchestrate automated login attempts.
Gift Card Fraud
Unit 42 reported on the credit card fraud-based Jingle Thief campaign in October 2025. We continue to track this activity as CL‑CRI‑1032 (aka Storm-0539).
AI-Powered Attacks
Back in May 2026, we predicted that threat actors would weaponize frontier AI models within 3–5 months. That prediction has already come true. Unit 42 recently disclosed an incident where a human attacker used frontier AI models to autonomously conduct various aspects of their intrusion to condense the timespan of their attack to under 10 hours. This typically would’ve taken multiple human operators at least two weeks to accomplish.
Since our report, several other security vendors have disclosed similar findings that directly relate to the types of threat that retailers are likely to face this peak shopping season. This includes Anthropic’s reporting on Bling Libra using Claude to accelerate reconnaissance and exfiltration activities. Gambit Security has reported on an attacker using multiple open source harnesses to steal more than 600,000 payment card records from retailers using JavaScript-based web skimmers. NorForge also published their own findings related to Gambit Security’s report on the usage of the Cairn autonomous penetration testing agent by a threat actor to infiltrate retail e-commerce sites, POS infrastructure, and web applications across the globe.
To defend against autonomous AI threats capable of compressing intrusion timelines to less than 10 hours, retailers must unify endpoint, network, cloud and identity data into an automated security operations infrastructure. Integrating centralized visibility with machine-learning triage and real-time automation orchestration enables security teams to:
- Swiftly isolate affected systems
- Invalidate compromised accounts
- Drastically reduce mean time to detect (MTTD) and mean time to respond (MTTR) from hours to minutes.
Conclusion
Peak shopping season is the most critical time of the year for retailers to ensure consistent operational uptime and maintenance of customer trust. The types of enterprise and guest-facing threats listed in this blog pose a clear and present risk to disrupting the core tenants of the retail shopping experience.
The ability for cyber defenders at retailers to reduce their MTTD and MTTR from hours to minutes is even more critical given the adoption of frontier AI models by financially-motivated actors.
To achieve this level of operational resilience, retail security teams can leverage the Palo Alto Networks security platform for an integrated, AI-driven security architecture that unifies enterprise-wide telemetry into automated response. Integrating Cortex XSIAM and XDR for real-time threat containment alongside Zero Trust network defense allows organizations to stop complex intrusions before they disrupt peak holiday operations. Furthermore, deploying Cortex Cloud will safeguard e-commerce platforms, protecting critical transaction paths from high-impact threat vectors.
If your retail organization experiences a cyber attack during peak shopping season, the Unit 42 Incident Response team is here and ready to support as needed.
Organizations can access tailored adversary intelligence, direct analyst consultations, and specialized exposure tracking through Unit 42 Threat Intel Services and its Deep and Dark Web Service.
