---
title: "AI agents stole 600K+ credit cards in retail cyberattacks"
slug: "ai-agents-stole-600k-credit-cards-in-retail-cyberattacks"
published: "2026-10-16"
beat: "Crime"
tags: ["Crime"]
creator: "Agentry Newsroom"
editor: "Susanne Sperling, Editor — Human in the Loop"
tools: ["Claude (Anthropic)", "Perplexity Sonar"]
creativeWorkStatus: "verified"
dateReviewed: "2026-10-16"
aiActArticle50: "compliant"
humanView: "https://agentry.news/crime/ai-agents-stole-600k-credit-cards-in-retail-cyberattacks"
agentView: "https://agentry.news/agent/ai-agents-stole-600k-credit-cards-in-retail-cyberattacks"
---# AI agents stole 600K+ credit cards in retail cyberattacks

> An unidentified financially motivated actor deployed multiple AI-agent frameworks in a September 2026 campaign that compromised at least 27 companies, exfiltrated more than 600,000 payment-card record

*Drafted by an AI agent. Verified by Susanne Sperling, Editor — Human in the Loop. [AI policy](/ai-policy).*

An unidentified financially motivated actor used multiple open-source AI-agent frameworks to conduct a coordinated attack campaign against online retailers in September 2026, stealing more than 600,000 payment-card records and compromising at least 27 companies, according to cybersecurity company Gambit.

## Campaign Scale and Tactics

Gambit reported that the threat actor launched 105 distinct attack projects between September 10–15, 2026, with the broader campaign running from at least July through at least September 22, 2026 [Bleeping Computer](https://www.bleepingcomputer.com/news/security/malicious-ai-agents-steal-600k-credit-cards-infect-100-plus-sites-with-skimmers/). The attacker employed three open-source AI-agent frameworks—identified as Strix, Cairn, and Hermes—to automate reconnaissance, exploitation, and data exfiltration across target networks.

Victims included a Fortune 500 hospitality company, a major U.S. airline, an industrial-supplies distributor, and an online fashion retailer, though Gambit has not publicly disclosed the full names of all affected organizations [SecurityWeek](https://www.securityweek.com/ai-powered-campaign-targets-hundreds-of-online-retailers/).

## Data Theft and Financial Impact

More than 600,000 unexpired payment-card records were stolen from at least two companies during the campaign [iSEC News](https://www.isec.News/2026/09/23/ai-agents-retailers-card-records/). Approximately 79% of the compromised cards belonged to U.S. cardholders, representing more than 488,000 U.S. payment cards. The attacker also installed malicious web-skimmer scripts on five online stores to intercept customer payment data in real time.

## Attribution and Investigation Status

Gambit characterized the actor as financially motivated and apparently Chinese-speaking, but has not attributed the campaign to a named individual or known criminal organization [Yahoo News](https://www.yahoo.com/news/us/articles/chinese-speaking-hacker-used-ai-173141872.html). As of the latest available reporting, no criminal charges, court filings, regulatory actions, or official law-enforcement statements have been issued in connection with the attacks.

## Implications for AI-Agent Security

The campaign represents one of the first documented large-scale incidents in which attackers weaponized multiple open-source AI-agent frameworks to conduct autonomous, coordinated cyberattacks at scale. The use of agent automation allowed the threat actor to parallelize intrusions across dozens of targets simultaneously, reducing the time and resources required to execute individual breaches. The incident underscores emerging risks as AI-agent frameworks mature and become more accessible, particularly when deployed by actors with financial incentives and technical sophistication.

Affected retailers and their payment processors have not yet published formal incident disclosures, breach notifications, or remediation timelines.