Akamai Security Research: Loyalty Programs Continue to be Targeted by Criminals as Account Data is Easily Sold or Traded Retail, Hospitality, Travel industries were hit with over 63 billion credential stuffing and 4 billion web application attacks in last two years
Cambridge, MA | October 21, 2020
Akamai (NASDAQ: AKAM) the intelligent edge platform for security and delivering digital experiences, today published the State of the Internet / Security report: Loyalty for Sale - Retail and Hospitality Fraud. The report details criminal activity targeting the retail, travel, and hospitality sectors with attacks of all types and sizes between July 2018 and June 2020. The report also includes numerous examples of criminal ads from the darknet illustrating how they cash in on the results from successful attacks and the corresponding data theft.
Criminals are not picky -- anything that can be accessed can be used in some way, said Steve Ragan, Akamai security researcher and author of the State of the Internet / Security report. This is why credential stuffing has become so popular over the past few years. These days, retail and loyalty profiles contain a smorgasbord of personal information, and in some cases financial information too. All of this data can be collected, sold, and traded or even compiled for extensive profiles that can later be used for crimes such as identity theft.
During the COVID-19 pandemic-related lockdowns in Q1 2020, criminals took advantage of the worldwide situation and circulated password combination lists, targeting each of the commerce industries featured in the report. It was during this time that criminals started recirculating old credential lists in an effort to identify new vulnerable accounts, leading to a significant uptick in criminal inventory and sales related to loyalty programs.
Between July 2018 and June 2020, Akamai observed more than 100 billion credential stuffing attacks in total. In the commerce category - comprising the retail, travel, and hospitality industries - there were 63,828,642,449 recorded. More than 90% of the attacks in the commerce category targeted the retail industry.
Credential stuffing isn't the only way that criminals target the retail, travel, and hospitality industries. They target organizations in these industries at the source using SQL Injection (SQLi) and Local File Inclusion (LFI) attacks. Between July 2018 and June 2020, Akamai observed 4,375,711,860 web attacks against retail, travel, and hospitality, accounting for 41% of the overall attack volume across all industries. Within this data set, 83% of those web attacks targeted the retail sector alone. SQLi attacks are an evident favorite among criminals, accounting for just under 79% of the total web application attacks against retail, travel, and hospitality.
As the global economy prepares for a holiday shopping season, it does so in an environment that has changed radically due to the pandemic. Consumers will not be standing outside of brick and mortar stores waiting for the latest deals in the same way they have in the past. They're going to log-in, collect their reward points, and maybe use loyalty programs to gain some discounts or other perks just for being a member.
Considering everything that goes into a successful loyalty program, and the information people need to provide in order to take part, the criminals have everything they need to get started in a number of crime-related ventures, from account takeovers, to straight-up identity theft. So, while an individual's loyalty to a merchant, airline, or hotel chain might not literally be for sale, there's a good chance the account associated with such programs might be.
All businesses need to adapt to external events, whether it's a pandemic, a competitor, or an active and intelligent attacker, Ragan concluded. Some of the top loyalty programs targeted require nothing more than a mobile number and a numeric password, while others rely on easily obtained information as a means of authentication. There is an urgent need for better identity controls and countermeasures to prevent attacks against APIs and server resources.
The Akamai 2020 State of the Internet / Security report, Loyalty for Sale - Retail and Hospitality Fraud is available here. In addition, Akamai will host a webinar on Thursday, October 22 at 11:00 a.m. ET where Akamai security experts discuss the findings of this latest report. To register for the webinar, visit here.
For additional information, the security community can access, engage with, and learn from Akamai's threat researchers and the insight that the Akamai Intelligent Edge Platform affords into the evolving threat landscape, visit Akamai's Threat Research Hub.
About Akamai Akamai secures and delivers digital experiences for the world's largest companies. Akamai's intelligent edge platform surrounds everything, from the enterprise to the cloud, so customers and their businesses can be fast, smart, and secure. Top brands globally rely on Akamai to help them realize competitive advantage through agile solutions that extend the power of their multi-cloud architectures. Akamai keeps decisions, apps and experiences closer to users than anyone - and attacks and threats far away. Akamai's portfolio of edge security, web and mobile performance, enterprise access and video delivery solutions is supported by unmatched customer service, analytics and 24/7/365 monitoring. To learn why the world's top brands trust Akamai, visit www.akamai.com, blogs.akamai.com, or @Akamai on Twitter. You can find our global contact information at www.akamai.com/locations.
Europe Stories
05/01/2027
Worlds first 802.15.4ab-UWB chip verified by Calterah and Rohde & Schwarz to be ...
07/10/2026
Dalet, a leading technology and service provider for media-rich organizations, today announced the latest Long-Term Supported (LTS) release of Dalet Flex. Build...
06/09/2026
June 9 2026, 23:00 (PDT) Dolby and MagentaTV Bring Fans Closer to the FIFA Worl...
04/08/2026
Dalet, a leading technology and service provider for media-rich organizations, t...
24/07/2026
First string library captured at Studio Richter Mahr
The latest sample library to be created at Max Richter's Studio Richter Mahr facility captures the ...
24/07/2026
Official emulation of Blackbird Studios reverb chamber
In their latest collaboration with Blackbird Studios, KIT Plugins have captured the sound of the Stud...
24/07/2026
Angela Gomez brings over 14 years of experience in broadcast communications and audio engineering, specialising in live outside broadcasts, live sports and larg...
24/07/2026
Article courtesy of postPerspective
Read the article
While Toy Story 5 maintai...
24/07/2026
Kerry and Mayo fans Up For The Match as excitement builds in Croke Park on the e...
23/07/2026
Staines-upon-Thames, UK, 23rd, JULY, 2026 - Yospace, the trusted leader in Dynamic Ad Insertion (DAI), stitched 11.57 billion one-to-one addressable advertisem...
23/07/2026
Quickly creates reverse reverb effects
Low End Candy have recently released a new plug-in that offers a quick and simple way to create reverse reverb effect...
23/07/2026
New engines, resonators, effects & more
Expressive E's versatile soft synth has just been treated to an update that greatly expands its sonic range. Noi...
23/07/2026
SGL Carbon has further expanded its photovoltaic capacity at its Ort im Innkreis site in Austria. With the commissioning of new PV carports, the sites solar sys...
23/07/2026
Rohde & Schwarz presents new software for three-phase power analysis on MXO seri...
23/07/2026
In our latest blog, Laura Rognoni explores how the launch of Play Snooker reflects a wider shift in sports economics - from monetising peak broadcast audiences ...
23/07/2026
Download Now!
To receive a short case study showcasing Vivid Broadcast's audio setup, please enter the following details:
--
First Name* First Name ...
23/07/2026
X-Rite Pantone and Fashion Institute of Technology (FIT) Partner to Advance Digi...
23/07/2026
Thursday 23 July 2026
New Samsung Galaxy Foldable range available now to pre-order on Sky Mobile
Sky Mobile, the award-winning network voted this year by Expe...
23/07/2026
Thursday 23 July 2026
Jason Statham leads Sky Original action thriller MUTINY in explosive new trailerTurn on cookies to view this content. Go to Privacy optio...
23/07/2026
Wuppertal July 23, 2026
Riedel Implements RefCam and Easy5G for the First Time...
23/07/2026
RT Commercial has today announced Centra as the official food partner once again of The Traitors Ireland, coming to RT One and RT Player later this year.
Ce...
23/07/2026
RT Commercial today announced Honda as sponsor of Today with David McCullagh RT Radio 1, weekdays 9am 11am.
Broadcasting directly after Morning Ireland in ...
23/07/2026
RT News is pleased to announce Barry Gallagher has been assigned as the new journalist covering news from Cork, Kerry and the wider Southern region
Working al...
22/07/2026
Library now available in Engine Player
Another of Eduardo Tarilonte's popular sample libraries has just been moved over to Engine Audio's Engine Pla...
22/07/2026
All-in-one mic & DSP interface overhauled
Cloudvocal have just refreshed the design of their all-in-one mic, audio interface and DSP processor, introducing ...
22/07/2026
The final boss of the lost dual-op-amp circuit
Electro-Harmonix have just introduced the Deluxe Big Muff Pi 2, which they say offers their latest take on t...
22/07/2026
eds3_5_jq(document).ready(function($) { $(#eds_sliderM519).chameleonSlider_2_1({ content_source:......
22/07/2026
A poisoned spy, a secret war, and a small English city contaminated by a deadly chemical weapon. Available on Sky Documentaries from 4 AugustWednesday 22 July 2...
22/07/2026
Audio at Parity: Comscore Launches Transcript-Level Targeting and Measurement wi...
22/07/2026
Arvato Systems and Lobster Enter into a Partnership and Combine the Integration Platform and Managed Services
Flexible integration solutions for cloud, hybrid...
22/07/2026
RT REPORTS NET SURPLUS OF 22.5 MILLION IN 2025...
22/07/2026
In the Opinion of the Censor airs Monday 27 July at 9.35pm on RT One and RT Player
In the Opinion of the Censor looks at how films for theatrical release wer...
21/07/2026
New research involving a cross-section of Mongolias independent media landscape finds enthusiasm for AI as a tool to improve efficiency, sustainability and resi...
21/07/2026
High-end analogue channel strip boasts plug-in recall
Originally revealed as a prototype back at NAMM 2024, the Channex Studio channel strip represented a b...
21/07/2026
Relies on same DSP as plug-in range
Musik Hack's line-up has been influenced heavily by founder Stan Greene's work as a mixing engineer, and their M...
21/07/2026
Official collaboration with boutique builder Dirty Boy Pedals
Warm Audio have just announced the launch of a new guitar pedal range created in collaboration...
21/07/2026
Rohde & Schwarz showcases broad range of EMC test solutions at EMC SIPI 2026 in ...
21/07/2026
X-Rite Pantone and NIFT Partner to Build Color Management Skills for India's...
21/07/2026
Harmonics cOS Virtualized Broadband Platform and Pearl Remote OLTs Enable Flexible PON Migration, While SeaStar Optical Node Powers Cost-Effective Multi-Gigabit...
21/07/2026
160 hours of Irish storytelling for 2026
KIN and The Walsh Sisters return
RT has today unveiled its most ambitious drama slate ever, with a record-breakin...
20/07/2026
Product range now readily available in the UK
Graph Tech Guitar Labs have just announced the launch of a new UK Online Store that makes it quicker and easie...
20/07/2026
Popular headset gains active noise cancellation
The Maxwell headet was Audeze's first foray into the gaming world, and thanks to its Dolby Atmos compati...
20/07/2026
Monday 20 July 2026
Sky brings free global roaming to millions of loyal custome...
20/07/2026
Red Seat Ventures Announces Introduction of Premium Creator and Podcast Communit...
20/07/2026
FIFA World Cup Final sets new RT Player record as the most-streamed single event in the platform's history
Over 1 million viewers watched live on RT 2 as ...
19/07/2026
Channel strip plug-in gets upgraded
Acustica Audio's vintage-inspired channel strip plug-in has just been treated to an update that expands its tonal ra...
18/07/2026
Captures nine sought-after Fender amps
IK Multimedia's latest TONEX expansion captures a selection of nine rare Brown Panel' Fender amps that were ...
18/07/2026
Latest batch ships alongside firmware update
Since being unveiled at Superbooth 2025, Frap Tools' debut polysynth has been met with widespread praise, a...
17/07/2026
Full engine access with reduced soundset
Sonuscore have steadily been introducing a selection of reduced-cost and free versions of their flagship products r...
Akamai Security Research: Loyalty Programs Continue to be Targeted by Criminals as Account Data is Easily Sold or Traded Retail, Hospitality, Travel industries were hit with over 63 billion credential stuffing and 4 billion web application attacks in last two years 
