Retail intrusion and data damage incident
Unnamed: online retailers · attacker-operated agent
- What happened
- Security firm Gambit Security reconstructed a campaign in which attackers used AI agents to choose and pursue ways into online retailers’ systems. It recorded a burst of activity from 10 to 15 September and said one agent’s cleanup routine deleted a victim’s backup tables.
- Impact
- Skimmers were ordered against at least 27 named victims and confirmed on 19 during the wider campaign (reported). Across the wider campaign, more than 600,000 payment-card records were taken from two companies (reported).
- What would have caught it
- Alert on rapid probing, unusual access to payment data and changes to storefront scripts. Restrict database deletion rights and keep backups outside the affected system.
- Sources
- Gambit Security investigation (source date 2026-09-22)