As of Sept. 30, 2026, ransomware operators have claimed 565 retail organizations as victims this year, with the median company revenue hovering around $22 million.
Retail holiday volumes: $1 trillion expectations and $1.3 trillion online
Retail peak season remains a lucrative horizon for both merchants and attackers. The National Retail Federation predicted retail sales would surpass $1 trillion for the first time during the 2025 holiday shopping season, and Salesforce later reported global online sales of $1.3 trillion — including $294 billion in the United States and $262 billion influenced by AI and agents. Cybercriminals are well aware that this period is usually the most profitable for retailers and deliberately time financially motivated campaigns to coincide with it.
Ransomware — TGR-CRI-1173 (The Gentlemen), Spikey Scorpius (Qilin), Howling Scorpius (Akira)
Ransomware remains a primary operational threat to retailers at peak season because successful attacks can disrupt in-store and online guest experiences and choke inventory flows. Unit 42 reports that three operators — TGR-CRI-1173 (aka The Gentlemen), Spikey Scorpius (aka Qilin) and Howling Scorpius (aka Akira) — were the top claimants of retail victims in 2026. The firm also cites a December 2023 example when Ambitious Scorpius (aka ALPHV) stole millions of customer records and caused delayed order fulfillment, canceled e-commerce orders and slowed inventory replenishment.
Unit 42 recommends automated containment and network segmentation as central defenses, including:
- Advanced endpoint protection with real-time behavioral analysis to rapidly isolate compromised assets
- Zero trust access to limit lateral movement
- Inline sandboxing to inspect suspicious binaries and block zero-day exploits before execution
Nobody's watching your logs at 2 AM.
Full SOC coverage without building one. Nubivance deploys and manages Rapid7 InsightIDR and MDR for organizations that need detection and response, not another dashboard.
Get coverageData theft and extortion — Bling Libra (ShinyHunters), Hazy Scorpius (CL0P)
Extortion without encryption continues to be significant; Unit 42 cites the 2026 Unit 42 Global Incident Response Report noting that non-encryption extortion incidents fell to 78% in 2025 from prior levels near 90%. Actors such as Bling Libra (aka ShinyHunters) and Hazy Scorpius (aka CL0P) accelerate monetization by stealing and publishing data rather than encrypting systems. One cited incident from December 2021 involved Bling Libra exfiltrating hundreds of gigabytes of customer email addresses, hashed passwords, customer payment invoices and internal employee files including salaries and tax IDs.
Defensive recommendations stress enterprise data loss prevention and exposure reduction:
- Comprehensive DLP across environments to detect and stop illicit exfiltration
- Continuous attack surface management to find and remediate publicly accessible systems
- Zero trust access enforcing least-privilege user and service access
DDoS and Noname057(16) using the DDoSia botnet
DDoS campaigns can paralyze e-commerce platforms at the busiest moments. Unit 42 describes a December 2025 incident in which pro‑Russian hacktivist group Noname057(16) used the DDoSia botnet to launch coordinated TCP SYN and HTTP GET floods that brought central systems offline, paralyzed package tracking tools, disrupted merchant payment services and delayed parcel processing across distribution networks.
Recommended mitigations focus on application-layer and edge protections:
- Dynamic rate-limiting controls to blunt request floods
- Automated mitigation to filter malicious connections
- Distributed edge networks to absorb large traffic spikes before they hit critical systems
Digital skimming (CosmicSting CVE-2024-34102) and credential stuffing
Digital skimming remains a favored technique for stealing payment card data; Unit 42 highlights an October 2024 incident in which actors exploited CosmicSting (CVE‑2024‑34102) to execute remote code on unpatched servers, install backdoors and inject payment‑skimming scripts into checkout flows — affecting roughly 5% of online stores on major e‑commerce platforms ahead of Black Friday and Cyber Monday. Credential stuffing is likewise called out as a recurring peak‑season problem: in December 2022 automated scripts targeted mobile apps and web login APIs, compromising thousands of loyalty accounts and enabling theft of stored gift card balances, mobile payment funds and rewards points.
Defensive measures in the report emphasize web and API protections:
- Web application and API protection (WAAP) solutions with bot mitigation
- Cloud security posture management and application security posture management to find and fix server vulnerabilities
- Timely remediation of unpatched flaws and correction of configuration drift before code freezes
How technologists, retail leaders, and customers should respond
Technologists and security teams should prioritize unified telemetry and automation: Unit 42 argues that integrating endpoint, network, cloud and identity data into an automated security operations infrastructure — with machine‑learning triage and real‑time orchestration — is necessary to isolate systems and invalidate accounts in minutes rather than hours.
Procurement and retail executives should watch for attackers monetizing gift cards and loyalty balances: Unit 42 tracks the Jingle Thief campaign (CL‑CRI‑1032 / Storm‑0539), which social engineers employees to obtain cloud credentials and issue unauthorized gift cards at scale, and recommends reinforcing controls on cloud access and employee phishing resilience.
Consumers should remain cautious about account reuse and saved payment credentials, because credential stuffing and data theft incidents cited by Unit 42 have repeatedly targeted stored payment instruments and loyalty balances.
Unit 42 warns that frontier AI models have already compressed intrusion timelines: a May 2026 prediction that attackers would weaponize these models within 3–5 months has been borne out, with incidents where human operators used AI to complete multi-step intrusions in under 10 hours. Unit 42 concludes that reducing mean time to detect and mean time to respond from hours to minutes is essential for maintaining uptime and customer trust during peak shopping season. The Unit 42 Incident Response team offers tailored incident response and threat intelligence support to retailers who experience attacks.
https://unit42.paloaltonetworks.com/unwrapping-retail-cyber-threats/
