Unit 42 warns retailers of evolving peak season cyber threats

Retailers are warned that peak holiday shopping season threats remain active and evolving, with Unit 42 outlining enterprise and guest-focused attack types to watch for as 2026’s peak period approaches.

The piece notes ransomware continues to threaten uptime and supply chains, citing that by 30 September 2026 operators had claimed 565 retail victims, with a median company revenue around $22 million; the top offenders include groups such as TGR-CRI-1173 (The Gentlemen), Spikey Scorpius (Qilin) and Howling Scorpius (Akira). An illustrative incident from December 2023 describes Ambitious Scorpius stealing millions of customer records and causing order delays and inventory disruption.

Prevention guidance emphasises automated containment, rigorous network segmentation, real-time behavioural endpoint protection, zero trust access and inline sandboxing to stop exploits before execution.

Data theft and extortion are also rising, with Bling Libra (ShinyHunters) and Hazy Scorpius (CL0P) highlighted as actors moving away from ransomware to quicker data exfiltration workflows. A notable example from December 2021 involved hundreds of gigabytes of data being stolen, including customer emails, hashed passwords, invoices and staff records. The piece also covers DDoS risks during peak periods, citing a December 2025 attack by Noname057(16) that disrupted portals, APIs and parcel processing.

Digital skimming persists, with October 2024 activity tied to CVE-2024-34102 affecting around 5% of online retailers’ stores prior to Black Friday and Cyber Monday, leading to recommendations for WAAP, CSPM/ASPM, vulnerability remediation and config drift correction.

Guest-focused threats include account takeover via credential stuffing seen in December 2022, gift card fraud linked to the Jingle Thief campaign (Storm-0539), and AI-powered attacks since May 2026 that autonomously accelerate intrusions. Unit 42 urges unified security architectures and automated response to reduce detection and response times, noting utilities such as Cortex XSIAM/XDR and Zero Trust as part of the mitigation narrative.