Unit 42 warns retailers of ransomware, extortion and DDoS
Original title: Unwrapping Retail Peak Season Cyber Threats
As of September 30, 2026, operators had claimed 565 retail victims, with median revenue about $22 million.
Palo Alto Networks Unit 42 says retailers should prepare for financially motivated attacks before the 2026 peak shopping season, citing ransomware, data-theft extortion and DDoS. It names The Gentlemen, Qilin and Akira as the top ransomware claimants against retail this year and recalls prior holiday-period incidents involving ALPHV, ShinyHunters, CL0P and Noname057(16)’s DDoSia botnet. Recommended controls include endpoint containment, segmentation, DLP, attack-surface management and application-layer DDoS filtering. The published excerpt cuts off during a digital-skimming section.
Unconfirmed: Retail victim totals are claims by ransomware operators, not confirmed incidents.
- Unit 42 says encryption-free extortion fell to 78% of extortion incidents in 2025, below 90% for the first time in years.
- A December 2025 DDoSia attack used TCP SYN and HTTP GET floods against web portals and APIs.
- A December 2023 ALPHV case is described as delaying fulfillment and canceling e-commerce orders.
- ShinyHunters is cited for a December 2021 theft of customer emails, hashed passwords and employee tax files.
Impact: Operational disruption, customer-data theft and e-commerce downtime
- 1.Use behavioral endpoint protection and segmentation to isolate ransomware.
- 2.Combine DLP, attack-surface management and least-privilege access against data theft.
- 3.Rate-limit and filter floods, and absorb spikes at the edge.
From the original article
8 min read at unit42.paloaltonetworks.com
Unit 42 explores key peak shopping season retail cyber threats, from ransomware to AI attacks, and shares how to defend operations and customer trust. The post Unwrapping Retail Peak Season Cyber Threats appeared first on Unit 42.
By Matt Brady and Christa McHugh · unit42.paloaltonetworks.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.