The Hackers Have Their Black Friday Shopping List. You’re On It.

Every retailer knows the Cyber Weekend numbers. Last year Australians spent a record $23.8 billion across the two-week Black Friday sales period, including about $8 billion online, according to CommBank iQ. In the US, shoppers spent a record US$11.8 billion online on Black Friday day alone, according to Adobe Analytics. In both markets, sales now start around Monday 23 November and run into December. For four or five days, a year’s worth of reputation and a meaningful slice of annual profit flow through your website, your apps, your payment systems and your stores.

Attackers see exactly the same calendar. To them, Black Friday is the one week a year when a retailer is most likely to pay to make a problem go away, when staff are least likely to question an odd request, and when a few minutes of downtime costs the most. This article is for the executives and technology leaders in Australia and the US who will be accountable if something goes wrong. It is deliberately light on jargon and heavy on what to do.

Why peak season is peak risk

Black Friday does not create new threats. It amplifies every existing weakness at the exact moment you can least afford it. Five things change at once.

• Noise hides attacks. During Black Friday 2025, retail traffic on Imperva’s network ran 37% above the November average, and bot attacks rose 50%. Attackers deliberately blend into the crowd of real shoppers. The US drew 46% of all the malicious Black Friday traffic Imperva observed, and Australia was second at 12%, ahead of the UK. Attackers go where the money is.
• The cost of downtime is at its highest. An hour offline in late November is worth many hours in February. Criminals know this, and it makes a ransom demand far more persuasive.
• Your people are stretched and new. Seasonal staff, contractors and agency workers are onboarded fast, often with generous access. Help desks and contact centres are flat out. Fatigued, busy people are easier to trick.
• Change freezes cut both ways. Most retailers lock down their systems before peak to protect stability. That is sensible, but it means a serious vulnerability discovered on 25 November may not be patched until January. As Unit 42 points out, two of the most disruptive global events of recent years, SolarWinds (December 2020) and Log4j (December 2021), both landed in December, when many retailers would have been in code freeze.
• The peak is getting longer. Sales now open around Monday 23 November and run into December. Imperva found traffic in 2025 stayed high across the whole weekend rather than dipping on Saturday. A longer peak is a longer exposure window, and a longer stretch for already tired teams.

---

The five threats that matter most this year

There are hundreds of ways to attack a retailer. These five do the most damage in peak season, and every one of them is preventable.

1. The phone call that walks past your security

The most expensive retail attacks of the past two years started with a conversation, not code. An attacker rings the IT help desk pretending to be an employee or executive, sounds convincing, and asks for a password reset or a new multi-factor authentication (MFA) device. Once the help desk says yes, the attacker logs in as a legitimate user. No malware, no alarms.

This is reportedly how attackers believed to be the Scattered Spider group got into Marks & Spencer and Co-op in April 2025, according to BleepingComputer and Reuters. The same playbook is used to steal gift-card systems: Unit 42 tracks a group known as Storm-0539 that phishes and texts retail staff for their logins, then quietly issues itself gift cards. Australians saw the same tactic in mid-2025, when a caller posing as IT support tricked an agent at a Qantas third-party contact centre and exposed the records of 5.7 million customers, according to Qantas. The OAIC later confirmed the caller had posed as Qantas IT help.

2. Ransomware and “pay or we publish” extortion

Ransomware locks your systems; extortion threatens to leak your customer data. Many groups now do one or both. Unit 42 counts 565 retail organisations claimed as ransomware victims in 2026 up to 30 September, and notes the median victim had revenue of only about US$22 million. This is not just a big-brand problem. Groups such as ShinyHunters and CL0P increasingly skip encryption altogether and simply steal data, because it is faster and still pays.

Timing matters. A ransom note on 27 November lands when you have the least tolerance for downtime and the most pressure to make it go away.

3. Bots, account takeover and loyalty theft

Criminals take passwords leaked from other websites and try them on your login page at industrial scale. Because so many people reuse passwords, a small percentage work. Those accounts hold saved cards, gift-card balances and loyalty points, all of which can be spent or resold within hours.

Imperva recorded a 50% jump in bot attacks over Black Friday 2025, aimed squarely at logins, product and inventory data, and promotions. In July 2026, US chain Chick-fil-A disclosed that credential-stuffing attacks in June had compromised the accounts of more than 13,000 customers. Bots also hoard limited stock and abuse sign-up offers, which hurts real customers and distorts your sales data.

4. Skimmers hidden in your checkout

Modern online stores run dozens of third-party scripts: analytics, chat, reviews, payments, marketing tags. If any one of them, or your e-commerce platform, is compromised, an attacker can add a few lines of code that copy card details as customers type them. The page still works, sales still go through, and you may not know for months.

In October 2024, attackers used a vulnerability called CosmicSting to plant skimmers on roughly 5% of stores on major e-commerce platforms ahead of Black Friday, per Unit 42. This year Gambit Security has reported an attacker using AI tools to steal more than 600,000 card records from retailers this way. Closer to home, in October 2026 Australian online retailer WAGD had to take its Shopify store offline after hijacked third-party apps redirected shoppers to fake payment pages, iTnews reported. The customer, not the retailer, spotted it first.

5. Your brand turned against your customers

Fake stores, lookalike domains, copycat social ads and “your parcel is delayed” texts all spike in November. Kaspersky detected more than 146,000 spam emails referencing seasonal sales in the first two weeks of November 2025 alone. Australians reported nearly $260 million in scam losses in the first nine months of 2025, with shopping scams among the most reported, according to the ACCC.

Stolen customer data makes these scams far more convincing. In October 2026, holiday park guests, including BIG4 customers, received WhatsApp and SMS scams quoting their genuine booking details after a security incident at booking software provider RMS Cloud. Even when you were not breached, customers blame the brand they thought they were buying from, and your contact centre absorbs the fallout.

---

What recent attacks in Australia, the US and the UK have taught us

The same handful of patterns shows up on every continent. Here are the incidents most relevant to retailers, newest first.

Organisation	Market	When	How they got in	What it cost
ASOS	UK	October 2026	Attacker impersonated a trusted contact to obtain an employee’s login, then accessed data on third-party platforms	Customer names and contact details exposed; no payment data or passwords
WAGD	AU	October 2026	Hijacked third-party Shopify apps redirected shoppers to fake checkout pages	Online store taken offline
Napoleon Perdis	AU	Disclosed Oct 2026	Records held by a former supplier, Retail Express, accessed between November 2025 and June 2026	339,055 customers’ names, contact details, purchase history and loyalty points exposed
Oz Hair and Beauty	AU	August 2026	Unauthorised access to the online ordering platform	Customer order data exposed; attackers claim 2.1 million records (unconfirmed)
Nick Scali	AU	August 2026	Cyber intrusion forced core systems offline	About three weeks without its ERP system, orders processed by hand, direct costs near $980,000
Chick-fil-A	US	June 2026 (disclosed July)	Credential stuffing (reused passwords)	More than 13,000 customer accounts accessed
Qantas	AU	June–July 2025	Caller posing as IT support tricked a third-party contact centre agent	5.7 million customers’ records stolen and later leaked online
Co-op	UK	April 2025	Help desk tricked into resetting a password	£206 million lost revenue in the half year; data of all 6.5 million members stolen; reportedly uninsured (Financial Times)
Marks & Spencer	UK	April 2025	Help desk reportedly tricked into resetting a password; M&S blamed human error at a third-party contractor	Online orders halted for about six weeks; an estimated £300 million hit to operating profit before insurance
Blue Yonder (Starbucks, grocers)	US	21 November 2024	Ransomware at a supply-chain software provider, days before Thanksgiving	Starbucks scheduling and payroll for about 11,000 North American stores went manual; UK grocers’ warehouse systems disrupted
VF Corp (Vans, The North Face)	US	December 2023	Ransomware and data theft at the height of the holiday season	Order fulfilment and store replenishment disrupted, orders cancelled; 35.5 million customers’ data stolen

Five lessons stand out for any retailer, wherever it trades.

1. Identity is the new perimeter. M&S, Co-op, Qantas and ASOS needed no sophisticated technical exploit. They needed one person to believe the wrong caller or reply to the wrong message. If your help desk or contact centre can reset a password or MFA on the strength of a phone call and a few facts found on LinkedIn, you are exposed.
2. Your suppliers are part of your attack surface. M&S blamed human error at a third-party contractor. Qantas was reached through an offshore contact centre, Napoleon Perdis through a former software supplier, and Starbucks through its scheduling provider. Verizon’s 2025 Data Breach Investigations Report found third-party involvement in breaches had doubled to 30%, and its 2026 edition puts it at 48%. You can outsource the service but not the accountability.
3. Resilience beats prevention on the day. Nick Scali kept selling by processing orders by hand. Starbucks went back to pen-and-paper rosters. VF Corp could still take online orders but could not ship them, and customers cancelled. The question is not just “can they get in?” but “how long can we keep trading if we have to pull the plug?”
4. Timing is deliberate. Blue Yonder was hit a week before Thanksgiving and VF Corp in mid-December. Semperis’s 2025 study, which included Australia, found more than half (52%) of organisations surveyed had been hit on a weekend or holiday, when staffing is thinnest.
5. Insurance and preparation are board decisions. Co-op reportedly had no cyber insurance; M&S recovered about £100 million through its policy. Neither outcome is decided on the day of the attack.

---

The Australian angle: what the law now expects

Australia is firmly on attackers’ radar and the regulatory consequences of a bad week have grown sharply. Four obligations should be front of mind before 27 November.

• Ransomware payments must be reported within 72 hours. Under Part 3 of the Cyber Security Act 2024, any business with annual turnover of $3 million or more that makes, or knows someone made on its behalf, a ransomware or extortion payment must report it to the Australian Signals Directorate (ASD) within 72 hours. The regime started on 30 May 2025 and moved from an education-first phase into active compliance in 2026. Failure to report attracts a civil penalty of up to 60 penalty units (currently $19,800). Your incident response plan needs a named owner for this clock, especially over a weekend.
• Data breaches must be assessed and notified fast. Under the Notifiable Data Breaches scheme, you have 30 days to assess a suspected breach and must notify the OAIC and affected customers as soon as practicable once it is likely to cause serious harm. Maximum penalties for serious interferences with privacy are now the greater of $50 million, three times the benefit obtained, or 30% of adjusted turnover. The OAIC secured its first-ever civil penalty under the Privacy Act in 2025.
• Individuals have a new right to sue. A statutory tort for serious invasions of privacy commenced on 10 June 2025. It requires intentional or reckless conduct, so an ordinary breach caused by weak security is unlikely to qualify on its own, but it adds to the regulatory and class-action exposure retailers already face.
• Card security rules have tightened. Since 31 March 2025, PCI DSS v4.0.1 requires merchants that host or embed their own payment pages to keep an authorised inventory of every script running on payment pages (requirement 6.4.3) and to detect unauthorised changes to those pages (requirement 11.6.1). Merchants using a fully hosted or redirected checkout (SAQ A) must instead confirm their site is not susceptible to script attacks. These directly target the skimming threat above. If you cannot show both are working today, that is a priority.

The US angle: a patchwork with sharp edges

There is no single US equivalent of Australia’s Privacy Act, but a retailer trading in the US faces overlapping federal and state obligations, plus a far more aggressive litigation culture. Five points matter most in peak season.

• Listed companies have four business days. Since December 2023, SEC-registered companies must file a Form 8-K (Item 1.05) within four business days of deciding a cyber incident is material, and must make that decision without unreasonable delay. VF Corp’s December 2023 attack was one of the first big retail disclosures under this rule, filed within three business days of detection. Someone senior needs to own the materiality call, including over a holiday weekend.
• Every state has its own breach law. All 50 states require you to notify affected residents, and many also require notice to the state attorney general. Definitions and deadlines differ, with some as short as 30 days. A national retailer can face dozens of overlapping clocks from one incident.
• Customers can sue, and do. Under the California Consumer Privacy Act, consumers whose data is exposed because a business failed to maintain reasonable security can claim statutory damages of US$107 to US$799 per California consumer per incident, without proving loss. Class actions now routinely follow large retail breaches.
• Paying a ransom can itself be illegal. The US Treasury’s Office of Foreign Assets Control (OFAC) warns that paying a sanctioned group can breach sanctions law, even if you did not know who was behind the attack. Australian retailers with US operations face the same risk. Get legal advice before any payment, and report to the FBI and CISA early.
• The FTC polices security promises. The Federal Trade Commission treats unreasonable data security, and claims about security you cannot back up, as unfair or deceptive practices.

---

Your 25-day plan

You cannot rebuild your security programme in three and a half weeks, and you should not try. The goal is to close the handful of gaps that attackers exploit most in peak season and to rehearse what happens if they get through anyway. Here is a realistic sequence.

This week (by Friday 6 November 2026): shut the easy doors

• Change the help desk rules. No password or MFA reset on the strength of a phone call alone. Require a call-back to a number already on file, manager approval, or video verification, and make it mandatory for executives, IT administrators and anyone with access to payments or gift cards. Brief every outsourced service desk in writing.
• Put phishing-resistant MFA on the keys to the kingdom. Passkeys or hardware security keys for administrators, remote access, cloud consoles, your e-commerce platform admin and gift-card systems. SMS codes are better than nothing but can be intercepted or socially engineered.
• Clean up access. Disable dormant accounts. Give every seasonal worker and contractor the minimum access they need, with an automatic expiry date in January.
• Know who answers the phone at 2am. Confirm your own on-call roster and get named, 24/7 contacts for your incident response firm, e-commerce platform, payment provider, cloud host and key suppliers. Print them. You may not have email when you need them.

Next two weeks (by Friday 20 November 2026): harden before the freeze

• Patch what faces the internet. Prioritise your e-commerce platform and plugins, VPNs, remote access tools and anything on ASD’s or CISA’s actively-exploited lists. Agree an emergency-change route so a critical fix can still go out during the freeze.
• Lock down your checkout. Inventory every script on payment pages, remove anything unused, and switch on change detection and alerting (PCI DSS 6.4.3 and 11.6.1, or the SAQ A script-attack check if your checkout is fully hosted).
• Tune bot defences on the pages that matter. Login, account creation, checkout, gift-card balance checks and promotions. Block known-breached passwords and watch login failure rates.
• Load-test with security switched on. Confirm your CDN and DDoS protection can absorb peak traffic plus an attack, and that defences do not block real customers.
• Prove you can recover. Make sure backups of critical systems are offline or immutable, then actually restore one. Know how many hours it takes.
• Run a 90-minute exercise. Scenario: “7am, Black Friday. Stores cannot take card payments, and an extortion note says customer data will be published in 48 hours.” Put the CEO, CFO, CTO, legal, communications and operations in the room. Decide now who can authorise taking systems offline, how you will trade manually, who owns each regulatory clock (in Australia, the 72-hour ransomware report and data-breach notification; in the US, the SEC’s four business days, state notices and the sanctions check before any payment), and what you will tell customers.
• Talk to your critical suppliers. Ask each one: who is on call over peak, how fast will you tell us about an incident, and have you tightened your own help desk?
• Protect your brand. Monitor for lookalike domains and fake social ads, line up a takedown service, enforce email authentication (DMARC set to reject), and tell customers exactly how you will and will not contact them.
• Check your insurance. Confirm what your cyber policy covers, its incident-response panel, and the notification steps the insurer requires.

Peak week (23 November to 1 December 2026): watch closely

• Staff a monitoring and response roster 24/7, with an executive decision-maker on call each shift.
• Watch for unusual gift-card issuance, loyalty redemptions, refunds and password-reset volumes. These are early signs of fraud and account takeover.
• Treat any urgent request to change access, payments or bank details as suspicious until verified through a separate channel.

After the dust settles

• Switch off seasonal access on schedule, review what was detected, and feed the lessons into next year’s plan while they are fresh.

The bottom line

The retailers that get through Black Friday unscathed are rarely the ones with the biggest security budgets. They are the ones that closed the obvious doors early, knew their suppliers’ weak spots, and had already rehearsed the bad day before it arrived.

Attackers have been planning for 27 November for months. With 25 days left, the best time to start was in September. The second-best time is this week.

---

Sources

• Unit 42 (Palo Alto Networks), Unwrapping Retail Peak Season Cyber Threats, 28/10/2026
• Imperva, Black Friday 2025 in Review: What Retailers Need to Know, 17/12/2025
• CommBank, Black Friday travel splurge lifts spending to record, December 2025
• ACCC, Australians report nearly $260M in losses as shopping scams surge
• IronSights, Australian data breach tracker (Nick Scali, Napoleon Perdis, Oz Hair and Beauty, RMS Cloud)
• iTnews, Shopify tells Australian store to stay shut after hijacked extensions divert shoppers (WAGD)
• IDM, How one phone call exposed 5.7M Qantas records; OAIC, Preliminary inquiries into Qantas 2025 data incident
• BleepingComputer, Chick-fil-A data breach affects more than 13,000 customers
• ASIS Security Management, Starbucks, grocers revert to manual processes after Blue Yonder ransomware attack
• BleepingComputer, Vans, North Face owner says ransomware breach affects 35 million people; VF Corp, Form 8-K, 18/12/2023
• Semperis, Global holiday ransomware study
• Cleary Gottlieb, New SEC disclosure rules for cybersecurity incidents
• California Privacy Protection Agency, CPI adjustments
• PCI Security Standards Council, Important updates for merchants validating to SAQ A
• Australian Signals Directorate, Annual Cyber Threat Report 2024–25 fact sheet for businesses
• Gadens, Mandatory ransomware payment reporting obligations now in force
• OAIC, Statutory tort for serious invasions of privacy
• Reuters via Business Insurance, M&S, Co-op cyberattackers duped IT help desks into resetting passwords; Retail Gazette, M&S cyber attack deepens
• Computer Weekly, Co-op declares cyber attack damage cost £206m
• BleepingComputer, ASOS links data breach to social engineering attack
• Kaspersky via CXOToday, 6.4 million shopping phishing attempts detected in 2025
• CyberScoop, IBM Cost of a Data Breach 2025

Disclaimer: This article is general information, not legal advice. Confirm your specific obligations in each market with your legal adviser.