Akamai Security Research: Loyalty Programs Continue to be Targeted by Criminals as Account Data is Easily Sold or Traded Retail, Hospitality, Travel industries were hit with over 63 billion credential stuffing and 4 billion web application attacks in last two years
Cambridge, MA | October 21, 2020
Akamai (NASDAQ: AKAM) the intelligent edge platform for security and delivering digital experiences, today published the State of the Internet / Security report: Loyalty for Sale - Retail and Hospitality Fraud. The report details criminal activity targeting the retail, travel, and hospitality sectors with attacks of all types and sizes between July 2018 and June 2020. The report also includes numerous examples of criminal ads from the darknet illustrating how they cash in on the results from successful attacks and the corresponding data theft.
Criminals are not picky -- anything that can be accessed can be used in some way, said Steve Ragan, Akamai security researcher and author of the State of the Internet / Security report. This is why credential stuffing has become so popular over the past few years. These days, retail and loyalty profiles contain a smorgasbord of personal information, and in some cases financial information too. All of this data can be collected, sold, and traded or even compiled for extensive profiles that can later be used for crimes such as identity theft.
During the COVID-19 pandemic-related lockdowns in Q1 2020, criminals took advantage of the worldwide situation and circulated password combination lists, targeting each of the commerce industries featured in the report. It was during this time that criminals started recirculating old credential lists in an effort to identify new vulnerable accounts, leading to a significant uptick in criminal inventory and sales related to loyalty programs.
Between July 2018 and June 2020, Akamai observed more than 100 billion credential stuffing attacks in total. In the commerce category - comprising the retail, travel, and hospitality industries - there were 63,828,642,449 recorded. More than 90% of the attacks in the commerce category targeted the retail industry.
Credential stuffing isn't the only way that criminals target the retail, travel, and hospitality industries. They target organizations in these industries at the source using SQL Injection (SQLi) and Local File Inclusion (LFI) attacks. Between July 2018 and June 2020, Akamai observed 4,375,711,860 web attacks against retail, travel, and hospitality, accounting for 41% of the overall attack volume across all industries. Within this data set, 83% of those web attacks targeted the retail sector alone. SQLi attacks are an evident favorite among criminals, accounting for just under 79% of the total web application attacks against retail, travel, and hospitality.
As the global economy prepares for a holiday shopping season, it does so in an environment that has changed radically due to the pandemic. Consumers will not be standing outside of brick and mortar stores waiting for the latest deals in the same way they have in the past. They're going to log-in, collect their reward points, and maybe use loyalty programs to gain some discounts or other perks just for being a member.
Considering everything that goes into a successful loyalty program, and the information people need to provide in order to take part, the criminals have everything they need to get started in a number of crime-related ventures, from account takeovers, to straight-up identity theft. So, while an individual's loyalty to a merchant, airline, or hotel chain might not literally be for sale, there's a good chance the account associated with such programs might be.
All businesses need to adapt to external events, whether it's a pandemic, a competitor, or an active and intelligent attacker, Ragan concluded. Some of the top loyalty programs targeted require nothing more than a mobile number and a numeric password, while others rely on easily obtained information as a means of authentication. There is an urgent need for better identity controls and countermeasures to prevent attacks against APIs and server resources.
The Akamai 2020 State of the Internet / Security report, Loyalty for Sale - Retail and Hospitality Fraud is available here. In addition, Akamai will host a webinar on Thursday, October 22 at 11:00 a.m. ET where Akamai security experts discuss the findings of this latest report. To register for the webinar, visit here.
For additional information, the security community can access, engage with, and learn from Akamai's threat researchers and the insight that the Akamai Intelligent Edge Platform affords into the evolving threat landscape, visit Akamai's Threat Research Hub.
About Akamai Akamai secures and delivers digital experiences for the world's largest companies. Akamai's intelligent edge platform surrounds everything, from the enterprise to the cloud, so customers and their businesses can be fast, smart, and secure. Top brands globally rely on Akamai to help them realize competitive advantage through agile solutions that extend the power of their multi-cloud architectures. Akamai keeps decisions, apps and experiences closer to users than anyone - and attacks and threats far away. Akamai's portfolio of edge security, web and mobile performance, enterprise access and video delivery solutions is supported by unmatched customer service, analytics and 24/7/365 monitoring. To learn why the world's top brands trust Akamai, visit www.akamai.com, blogs.akamai.com, or @Akamai on Twitter. You can find our global contact information at www.akamai.com/locations.
Europe Stories
05/01/2027
Worlds first 802.15.4ab-UWB chip verified by Calterah and Rohde & Schwarz to be ...
09/10/2026
September 10 2026, 06:00 (PDT) Dolby Expands Dolby OptiView Platform with New Capabilities at IBC 2026
New Sports Intelligence helps providers better unders...
07/10/2026
Dalet, a leading technology and service provider for media-rich organizations, today announced the latest Long-Term Supported (LTS) release of Dalet Flex. Build...
02/10/2026
v1.9.3 introduces AUv3 support
Roland have just released an update that kits their free iPad-based software synth out with AUv3 support, meaning it can now ...
02/10/2026
Dolby Atmos support, AI-powered stem separation & more
The latest version of MOTU's DAW software is now available, and marks a major step forward with t...
02/10/2026
Portable DAC created in collaboration with Steve Levine
British hi-fi experts iFi audio have unveiled a new Master Tuned variant of their praised iDSD GR2 p...
02/10/2026
In our latest blog, Tim Pearson looks at streaming piracy from a different lens, focusing on digital trust, consumer risk, and the future of subscriber protecti...
02/10/2026
Featuring performances recorded in Cork, Kilkenny, Wesmeath and Dublin culminati...
02/10/2026
Friday 2 October 2026
Crystal Lake, a Friday the 13th' prequel series, com...
02/10/2026
Friday 2 October 2026
Sky VIP helps families celebrate the Christmas season wit...
02/10/2026
How the fertility sector in Ireland remains unregulated
Undercover filming reveals how without proper regulation the promotion of controversial fertility treat...
02/10/2026
Transforming Homes, Transforming Lives
Presenter Baz Ashmawy and his team take on four life-changing builds across Kildare, Limerick, Wicklow and Offaly in the...
01/10/2026
Third collaboration with celebrated composer
Spitfire Audio have once again teamed up with Grammy-nominated composer, producer and technologist BT, creating...
01/10/2026
FL Studio gets dedicated grid controller
Novation have teamed up with FL Studio developers Image-Line to create another dedicated controller for the popular...
01/10/2026
Six new USB interfaces introduced
Universal Audio's USB audio interface line-up has just been refreshed, gaining six new models aimed at musicians, prod...
01/10/2026
Siretta's SNYPER-5G cellular network analyser has been shortlisted for the IoT Global Awards 2026.
The IoT Global Awards recognise products, services and o...
01/10/2026
Mesh Broadcast Services Fits Big-Truck Audio Power into Compact Eclipse Unit with Calrec Argo M Canadian OB company Mesh Broadcast Services has fitted its Eclip...
01/10/2026
X-Rite Pantone Launches Spectura to Advance Connected Color Quality from Lab to ...
01/10/2026
Thursday 1 October 2026
Nominees revealed for 2026 Sky Arts Awards
Current slide, 0 0, undefined1
0
Irish National Opera and Jennifer Walshe: MARS
Jacob Al...
01/10/2026
Vital TV antenna replaced at SudburyHelicopter and broadcast engineers work together to upgrade TV services for 1.5M in the East
--
Share to Linkedin
Octobe...
01/10/2026
Arqiva appoints Simon Duffy as ChairSimon Duffy joins as Chair effective 01 October 2026
--
Share to Linkedin
October 1, 2026
Press Office
01 October 2026...
01/10/2026
Season 4 of the multi-award-winning hit entertainment series The 2 Johnnies Late Night Lock In is back, serving up another round of unpredictable laughs, unforg...
01/10/2026
New season begins Sunday, 4 October at 6pm on RT lyric fm and RT Listen
RT lyric fm's arts and culture documentary series The Lyric Feature returns on S...
01/10/2026
RT is proud to continue its commitment to supporting and celebrating the arts across Ireland this October, highlighting a vibrant programme of theatre, music, ...
30/09/2026
Add an envelope generator to any plug-in
Sync Audio's latest creation is a handy utility plug-in that can be used to combine and modulate other effects ...
30/09/2026
All-analogue tape-style drive joins Series A
Strymon's reputation was built on their digital knowhow, so many were surprised (and intrigued) when they a...
30/09/2026
Two new expansion packs released
Sonuscore have just introduced two new expansion packs for The Pulse, its production engine instrument for modern cinematic...
30/09/2026
eds3_5_jq(document).ready(function($) { $(#eds_sliderM519).chameleonSlider_2_1({...
30/09/2026
New Solution Expands Harmonic's Network Intelligence Portfolio and Brings Comcast-Developed Fiber Monitoring Technology to Broadband Operators, Providing Re...
30/09/2026
How to Shop Well Now starts Monday at 9.35pm
on RT One and RT Player
On the...
29/09/2026
Two new plug-ins launch alongside updated bundles
Zynaptiq have just announced the launch of two new plug-ins, alongside new and improved versions of two of...
29/09/2026
All-in-one bus processor revealed
Wes Audio's ng product range has come a long way since it was first introduced, and now includes a tasty selection of ...
29/09/2026
eds3_5_jq(document).ready(function($) { $(#eds_sliderM519).chameleonSlider_2_1({ content_source:......
29/09/2026
NOT FOR RELEASE, PUBLICATION OR DISTRIBUTION IN OR INTO OR TO ANY PERSON LOCATED OR RESIDENT IN, OR AT ANY ADDRESS IN, THE UNITED STATES OF AMERICA, ITS TERRITO...
29/09/2026
We tend to think we live in a digital world, with hopes and fears around artificial intelligence (AI), quantum computing, data centres and the next big technolo...
29/09/2026
Today, in partnership with the American Academy of Pediatrics (AAP), Apple relea...
29/09/2026
Final Cut Camera, the professional filming app for iPhone, receives a major upda...
29/09/2026
RT lyric fm is proud to announce the annual Choirs for Christmas competition callout. Warm up those vocal chords and join us on RT lyric fm for a celebration ...
28/09/2026
EQ plug-in can now be played via MIDI
Scaler Music have recently released a new and improved version of their patented musical EQ plug-in, kitting it out wi...
28/09/2026
New synth developed in collaboration with philterSoup
Boutique effects pedal and Eurorack manufacturer Animal Factory Amps have announced that the new compa...
28/09/2026
Rohde & Schwarz adds an integrated multi-channel pulse analysis option to its FS...
28/09/2026
Monday 28 September 2026
Sky launches Full Fibre 1.6 Gbps for millions of homes
Sky has launched a new Full Fibre 1.6 Gbps product, rolling out from today, gi...
28/09/2026
Arvato Systems Highlights It's Role for Automotive Manufacturers and Suppliers
TISAX
Arvato Systems has successfully completed the TISAX Level 3 assess...
28/09/2026
Crimecall, presented by Carla O'Brien, returns tonight for a brand new series at 9.35pm on RT One and RT Player.
In tonight's episode, alongside appe...
28/09/2026
CELEBRATING 40 YEARS AT THE HEART OF NEW IRISH WRITING
LIVE FROM POETRY IRELAND, DUBLIN AND ON RT RADIO 1 FROM 7PM
DETAILS: www.rte.ie/writing | FOLLOW: #r...
27/09/2026
New compact pedal packs in 120 effects
The latest multi-effects pedal from Boss is a compact unit that promises to give any pedalboard a massive boost in s...
26/09/2026
Launched alongside three new expansion packs
In celebration of their 30th anniversary, Native Instruments have released a major update for their Maschine 3 ...
25/09/2026
Algorithm update & new DVA vibrato-detection engine
A new flagship version of Antares' iconic pitch-correction software has arrived, and along with a co...
25/09/2026
New flagship unit to arrive in early 2027
Two notes Audio Engineering have revealed that a new and improved version of their hugely popular reactive load bo...
Akamai Security Research: Loyalty Programs Continue to be Targeted by Criminals as Account Data is Easily Sold or Traded Retail, Hospitality, Travel industries were hit with over 63 billion credential stuffing and 4 billion web application attacks in last two years 
