AI Agents Hacking Online Retailers: 600,000 Card Records Stolen

Posted on Oct 16 • Originally published at untrace.network

A customer enters their card details to buy something online. Behind the checkout page, a hidden script captures the payment information. Elsewhere, an attacker extracts stored card records from a retailer’s database.

This is AI hacking with measurable consequences: stolen financial information, compromised businesses and, in one case, destroyed database tables.

On 22 September 2026, Gambit Security published an investigation into a campaign that used three open-source AI tools to attack online retailers. Researchers reported more than 600,000 unexpired credit card records stolen from two companies.

The operator’s own review recorded an average cost of $25.46 per completed scan across 101 scans. That is not the cost of every successful intrusion, but it illustrates the economics behind AI-powered cyberattacks: automated work can make investigating large numbers of targets inexpensive.

For businesses, the question of AI protection reaches beyond stopping an intrusion. It includes limiting what becomes readable if an attacker succeeds.

The campaign combined three tools with distinct responsibilities.

Between 23 and 31 August, Strix ran 146 times against 138 hosts. Between 10 and 15 September, the operator launched 105 attack projects. Gambit identified at least 27 companies compromised to varying degrees.

An AI attack could therefore involve a sequence of tools, decisions and repeated attempts, with a human setting the objective and software carrying much of the workload.

This is what makes AI agents hacking businesses significant. Their contribution extends beyond writing a convincing phishing email: they can use tools, interpret results and continue investigating a target.

A person chose the targets and issued instructions.

Gambit counted 1,951 human prompts across 260 Hermes sessions. In one example, the operator supplied a list of 301 retailers from a traffic-ranking service and instructed the system to investigate them.

The human remained responsible for the campaign. AI hacking expanded the amount of technical work that person could organise.

An AI agent attack also remained dependent on the target’s weaknesses and the access obtained. Automation did not make every attempt successful.

Gambit explained that its reconstruction combined stolen data, verified compromises, logs and reports generated by the tools. Some findings could not be independently confirmed, and the researchers acknowledged possible inaccuracies in their interim analysis.

That distinction matters when evaluating AI-powered cyberattacks: observed theft is stronger evidence than an agent’s claim that it succeeded.

The largest confirmed payment-data total came from two companies: more than 600,000 unexpired card records. Gambit worked with fraud specialist Overwatch Data to handle the compromised cards and notify issuers.

The campaign also planted checkout skimmers. These scripts capture payment information as customers use a compromised website. Gambit reported confirmed installations on 19 named victims and more than 100 additional websites carrying an associated skimmer.

AI agents hacking retailers created exposure through both stored data and active checkout pages. Those are different security problems, and both require attention.

Some victims also suffered destructive cleanup. At a bicycle retailer, an agent’s cleanup operation dropped 180 database tables, including backup tables created by the retailer’s administrators.

The damage from an AI attack can therefore outlast the theft. A business may need to investigate exposed records while also recovering systems and information that were deleted.

One documented intrusion provides the clearest connection between AI hacking and storage design.

The AI agent attack progressed from an application vulnerability to administrator access, then deeper into the retailer’s infrastructure. It reached a secrets store containing 46 secrets, obtained access to the main database and extracted the encryption key used to decrypt stored card information.

The records were encrypted. The attacker also obtained the means to read them.

An AI agent attack does not have to defeat the mathematics of encryption when compromised access exposes a usable decryption key.

This is a practical lesson for AI protection: protect the keys and the paths that can use them, as well as the encrypted data itself.

The campaign combined established techniques with automation. AI agents hacking these systems still depended on exploitable applications, accessible credentials and permissions that allowed them to move further.

What changed was the capacity to sustain that work across many targets.

For organisations preparing for an AI attack, patching, access controls and monitoring remain essential. Stored files deserve a separate question: what could someone obtain by copying everything from one provider?

Customer exports, contracts, identity documents and confidential reports can remain valuable long after their original use. Keeping those files should not mean concentrating every readable document behind one provider’s security.

AI protection is more useful when it addresses this consequence directly. Untrace Network is designed to limit what a breach of one storage provider can expose.

Untrace Network is data storage designed so that compromising a single storage provider cannot expose complete, readable documents.

Each file is encrypted in your browser before it leaves your device. It is then divided into six pieces, called shards, distributed across three independent providers.

Rebuilding the encrypted file requires any three shards. Reading it also requires the decryption key. No single provider holds enough shards to reconstruct it.

For someone concerned about AI hacking, that changes a specific outcome: copying one provider’s stored data yields encrypted fragments rather than readable files.

The design addresses three parts of stored-file exposure.

Files are encrypted before storage. The providers receive encrypted pieces and cannot read the original documents.

Access is granted file by file. An authorised person opens a file using their passkey, with verification through their device. There is no account-wide password or server-side decryption key that opens every file.

One provider holds too little to reconstruct a file. A breach of that provider does not supply enough shards to rebuild the encrypted document.

These controls give Untrace Network a specific role in preparation for AI-powered cyberattacks: protecting stored documents and exports even when one storage provider is compromised.

They complement security for live databases, checkout pages and employee devices. Files already opened or downloaded still need protection where they are used.

The evidence of AI agents hacking retailers is already concrete: stolen card records, malicious checkout scripts and destructive database operations.

You do not need to predict the next victim to improve how your own files are stored. An AI attack is a risk to prepare for before sensitive information becomes someone else’s possession.

AI hacking makes it more urgent to examine what an intruder could reach. AI-powered cyberattacks make that examination relevant to businesses of every size.

With Untrace Network, AI protection becomes a practical storage decision: encrypt files before upload, distribute their pieces, and grant access file by file.

Store your contracts, confidential reports, identity documents and sensitive exports with protection built into the architecture.

Try Untrace Network today. Make your important files harder to expose.

Originally published at untrace.network.