Palo Alto Networks Unit 42 published a report on October 28, 2026, outlining the primary cyber threats and autonomous attacks targeting retailers ahead of the 2026 peak shopping season.
Ransomware and Extortion Trends
According to Unit 42, ransomware operators claimed 565 retail organizations as victims as of September 30, 2026, with a median company revenue hovering around $22 million. The top three ransomware groups targeting retailers are TGR-CRI-1173, Spikey Scorpius, and Howling Scorpius. Meanwhile, data theft and extortion attacks continue to rise, with the 2026 Unit 42 Global Incident Response Report noting that extortion incidents without encryption accounted for 78% of cases in 2025.
Notable historical events cited in the report include a December 2023 ransomware incident involving Ambitious Scorpius and a December 2021 data theft incident involving Bling Libra. To mitigate these risks, Unit 42 advises deploying automated containment mechanisms, network segmentation, and enterprise data loss prevention controls.
DDoS and Digital Skimming Risks
Retailers also face significant risks from distributed denial of service attacks and digital skimming during high-traffic periods. During the December 2025 holiday rush, the pro-Russian hacktivist group Noname057(16) used the DDoSia botnet to target web portals and APIs, causing operational disruptions. In digital skimming, threat actors previously exploited the CosmicSting vulnerability (CVE-2024-34102) in October 2024 to inject payment skimming scripts into checkout flows.
Organizations are urged to deploy dynamic rate-limiting controls, distributed edge networks, and web application and API protection solutions to defend against these attack vectors.
AI-Powered Attacks and Autonomous Intrusions
Unit 42 highlighted an incident where an attacker used frontier AI models to conduct an intrusion in under 10 hours, a process that normally takes two weeks. Additional reports from Anthropic, Gambit Security, and NorForge detailed similar AI-driven attacks, including the use of Claude and the Cairn autonomous penetration testing agent to target retail infrastructure.
To defend against these fast-moving autonomous threats, retail security teams are advised to unify endpoint, network, cloud, and identity data into an automated security operations infrastructure to accelerate detection and response times.
What to do
- Deploy automated containment mechanisms featuring real-time behavioral analysis and enforce zero trust access across the enterprise.
- Implement comprehensive enterprise data loss prevention (DLP) controls and continuous attack surface management to restrict illicit data exfiltration.
- Combine dynamic rate-limiting controls, automated mitigation, and distributed edge networks to defend against DDoS attacks.
- Implement web application and API protection solutions alongside advanced bot mitigation to prevent digital skimming and account takeover.
Key facts and where they come from
- Ransomware operators claimed 565 retail organizations as victims as of September 30, 2026.
As of Sept. 30, 2026, ransomware operators have claimed 565 retail organizations as victims this year
- Extortion incidents without the use of encryption dropped to 78% in 2025.
extortion incidents without the use of encryption (78%) in 2025 dropped below the 90% range
- The CosmicSting vulnerability (CVE-2024-34102) was exploited in October 2024 for digital skimming.
exploited the CosmicSting vulnerability (CVE-2024-34102) to execute remote code on unpatched servers.
