Unwrapping Retail Peak Season Cyber Threats
Our summary
Palo Alto Networks' Unit 42 has published a warning about the surge of cyberattacks that typically hit retailers during peak holiday shopping periods, drawing on incidents observed since 2020. The report notes that as of September 30, 2026, ransomware groups including The Gentlemen, Qilin and Akira have claimed 565 retail victims this year, while extortion-without-encryption tactics used by actors like ShinyHunters and CL0P now account for 78% of such incidents. It also flags ongoing risks from DDoS campaigns (such as the December 2025 Noname057(16) attacks using the DDoSia botnet), digital skimming via the CosmicSting flaw tracked as CVE-2024-34102, credential-stuffing account takeovers, and gift-card fraud from groups like Storm-0539. A notable new concern is the rise of AI-assisted intrusions, where attackers reportedly used frontier AI models and autonomous agents to compress attack timelines to under 10 hours and steal over 600,000 payment card records, prompting Unit 42 to urge retailers to adopt automated detection and response platforms ahead of the 2026 holiday season.
Below is the opening; the full story is at Palo Alto Unit 42.
From Palo Alto Unit 42
Introduction
During the 2025 peak holiday shopping season, the National Retail Federation predicted that retail sales would surpass $1 trillion USD for the first time, with Salesforce later reporting that online sales equated to $1.3 trillion globally. This included $294 billion in the United States and $262 billion influenced by AI and agents. Cybercriminals are highly aware that the holiday season is generally the most profitable for retailers, and look to capitalize on it for their own financial gain.…
Worried this affects your company?
Discuss a security assessment of your internet-facing systems. Scope agreed before testing.