One person broke into the websites of more than a hundred companies in under three weeks, and did almost none of the work himself. He rented software that did it for him. The bill came to about five thousand dollars.
What actually happened
A security researcher named Snorre Fagerland, who works at the firm NorForge, spent the start of October looking for copies of a tool called Cairn that had been left open to the internet by mistake. Cairn is free software that lets several AI agents — programs that can take a goal and work through the steps on their own — cooperate on one job.
He found about two dozen of those open copies being used for attacks, and could watch them work. The busiest belonged to a Chinese-speaking hacker.
The campaign began on 25 September against online shops in the United States, Canada, Australia and Japan. By late last week the agents had tried more than 1,200 websites and broken into more than 100 companies, according to the report Reuters published today.
The hacker’s written instruction fit in fewer than 100 Chinese characters: get inside, and leave a way back in. After that the agents ran alone, spending about 23 hours on each site before it gave way.
All of it cost roughly five thousand dollars in AI usage. That is about fifty dollars per successful break-in.
Reuters identified some victims by following the hacker’s own activity: Deere, which makes farm equipment; SharkNinja, which makes home appliances; and Cummins, which makes engines. Deere said it had cleaned up and found no sign that sensitive information was taken. SharkNinja said the affected page was a separate support site. Cummins said it was investigating an attack on a website run by a supplier. Whether data left any of them, Reuters could not establish.
Why this matters to you
Look again at that list. These are not banks. They are the kind of company website where you check a warranty, book a repair, or type your address to order a spare part.
That is the change. Breaking into a website used to need people — skilled people who cost a salary, slept at night and lost interest after the fortieth attempt. Software does not.
What a company like that holds about you is dull: your name, your email, your address, what you bought and when. Dull is useful to a criminal. A message that opens with your real order number and your real street is far more convincing than one that opens “Dear customer”.
And you may never hear about it. Three weeks into this campaign, the researcher could not say what had been taken.
What you can actually do
You cannot secure a stranger’s website. You can make what sits on it worth less.
- Buy as a guest when you can. An account in a shop means the shop keeps your address and order history for years. Guest checkout leaves much less behind.
- Delete saved cards. When a shop offers to remember your card “for next time”, decline. If you already said yes, open the shop account, go to Payment methods or Wallet, and remove it.
- Use a different password on every shop. This is the most useful habit in the article. When one site falls, the password should be worthless everywhere else. The password manager built into your phone or browser will remember them for you.
- Turn on two-step verification where money moves — your bank, PayPal, your email. Two-step means a short code in addition to your password, so a stolen password alone is not enough.
- Check what is already loose. Go to haveibeenpwned.com and type your email address. It lists known leaks. If yours appears, change that password and every place you reused it.
- When a company writes “we had an incident”, be careful with the next email. The breach letter is real. The “claim your compensation” message that follows is usually not. Go to the company’s own site, never a link in the message.
Common misunderstandings
Myth: hackers only bother with big companies
The tool goes wherever the door is weakest, and a support page for a product is often weaker than a bank. Nobody watches it, nobody pays to have it tested. Small and unglamorous is what makes a target cheap.
Myth: if someone had my password, I would know
Usually you would not. A break-in can stay quiet for months, and the company itself may not know what left. The practical answer is to protect the accounts that matter as if the others were already exposed.
Myth: this is clever AI doing something we cannot stop
It is not clever, it is patient. It tries a door, fails, moves to the next one, and never gets bored — which is exactly what a person cannot do for 23 hours straight. What stops it is ordinary: a shop that keeps its software current, and a customer whose password is worth nothing anywhere else.
What to watch for next
More of this, not less. The same researcher watched other hackers on the same tool: one taking card numbers, another pointing agents at a cryptocurrency exchange.
Expect breach letters from companies that never had anyone responsible for security — and expect the letter to be followed by fakes, using the company’s own apology as bait.
The one thing to remember
Breaking into a website now costs about the price of dinner for two, and it no longer needs anyone to sit there and do it.
So give away as little as you can, keep one password per shop, and put a second lock on anything that holds money. Being uninteresting is a defence.
Image: “Bras robotisés” by Gzen92, Wikimedia Commons, CC BY-SA 4.0.