$25 per breach: how AI agents attacked hundreds of online stores and stole 600,000 payment cards
An attacker handed the job of hacking online retailers to AI agents and barely intervened. The result: more than 600,000 stolen payment cards, skimmers on 119 websites and an average cost of about $25 per targeted company.
## What happened
On 22 September 2026 Gambit Security published an investigation into a campaign against online stores that was carried out almost entirely by AI agents. The attacker — a financially motivated actor who appears to be based in China — gave the agents a general objective and afterwards only occasionally issued short instructions. The agents did all of the technical work themselves.
The campaign has been running since at least July and was still active at the time of publication.
## Three agents, one attack chain
The attacker built the operation from three open-source AI tools:
- **Strix** scans websites and looks for vulnerabilities. Between 23 and 31 August alone it ran 146 scans against 138 hosts — 633 hours of work in total;
- **Cairn** breaks into the targets it is given: it obtains access to the server or the admin panel;
- **Hermes** orchestrates the whole operation and makes the post-exploitation decisions. It runs on the claude-opus-4.6 language model and contains a persona called "SOUL — Red Team Operator" with 121 skills, 78 of them attack-related.
Targets were not picked at random. The attacker ran Strix's list of sites through a traffic-ranking service and went first after large sites running custom software, where vulnerabilities are more common. Access was often obtained within just a few hours.
## How the card data was stolen
To intercept payment data, the agents planted a skimmer on the sites — a script that copies card details the moment they are entered. The method depended on the level of access obtained:
- appending malicious code to the end of legitimate JS files;
- inserting a script into the checkout page or into a Google tag block;
- poisoning files in S3/CDN and server-side caches;
- modifying database fields;
- altering Kubernetes deployments;
- setting up cron jobs that restored the skimmer if it was removed.
The attack had a side effect as well. After exfiltration, the agents followed the attacker's instruction to wipe card numbers from Magento databases. One of the Hermes skill files says it plainly: download all card data, then clear the source fields in batches. Several stores suffered operational disruptions because of the lost data.
## Scale
- skimmers found on at least **119 websites**;
- **105 attacks** launched between 10 and 15 September alone, at least **27** of them successful to some degree;
- more than **600,000** valid payment cards stolen from just two companies;
- victims include a Fortune 500 hospitality company, a major US airline, a large US industrial supplies distributor and an online fashion retailer.
Almost 80% of the stolen cards belong to US cardholders; the rest come from the UAE, Saudi Arabia, the United Kingdom and nearly two hundred other countries.
## $25 per company
The researchers gained access to the attacker's staging server and were able to calculate the costs. By 25 August about $7,000 had been spent on AI services through OpenRouter, and Gambit estimates the total for the whole campaign at $12,000 to $18,000.
Per target, that comes to about **$25 per attacked company**: from $3 for the cheapest to $79 for the most expensive.
## The takeaway
Attacks on online stores have become cheap, fast and almost fully automated. A campaign like this no longer needs a team of skilled hackers — one operator with a budget of a few thousand dollars is enough. That puts not only large retailers at risk, but also small shops that attackers previously didn't bother with.
One more thing: you now have to prepare not only for data theft, but also for data loss — attackers may wipe it on the way out.
If you want to check how well your online store is protected, [get in touch](/contact).
---
*Based on research by Gambit Security (22.09.2026) and reporting by BleepingComputer and TechTimes. The names of the affected companies have not been disclosed.*