Why Cybercriminals Target Retailers at Peak Shopping Season, and What to Watch For

Peak shopping season is the most profitable time of year for retailers, and criminals know it. Unit 42 notes that the National Retail Federation predicted 2025 holiday retail sales would pass $1 trillion USD for the first time, while Salesforce reported global online sales of $1.3 trillion, including $262 billion influenced by AI and agents. Cybercriminals look to cash in on that surge for their own financial gain.

Unit 42's research looks at the threats retailers should prepare for ahead of the 2026 peak season. It covers attacks aimed at both the business itself and its customers, and examines the growing trend of autonomous attacks. It also recalls that major security events have tended to surface late in the season, including the SolarWinds supply chain compromise in December 2020 and the Log4j zero-day exploitation in December 2021. Both were hard to handle because code freezes were likely in place, which limits the changes teams can make to critical systems without risking disruption.

Ransomware is highlighted as a major concern. An attack could disrupt in-store and online customer experiences and interfere with inventory and supply chain needs. Unit 42 bases its focus areas on years of activity against Fortune 100 retailers, but the underlying lesson applies to smaller retailers too: the busiest weeks are when disruption hurts most.