Akamai State of the Internet Security Report: Retailers Most Common Credential Stuffing Attack Victim; Points to Dramatic Rise in API Traffic as Key Trend
Cambridge, MA | February 27, 2019
According to the Akamai 2019 State of the Internet / Security: Retail Attacks and API Traffic report, hackers directed credential abuse attempts at retail sites more than 10 billion times from May to December last year, making retail the most targeted segment studied. The report also spotlights two other pressing security concerns, the preponderance of API-call traffic on the web and the apparent misrepresentation of IPv6-based traffic.
The Company studied the credential abuse technique known as credential stuffing, where hackers systematically use botnets to try stolen login information across the web. They target login pages for banks and retailers on the premise that many customers use the same login credentials for multiple services and accounts. Interest in retail is driven by the value of merchandise, which hackers acquire through compromised accounts and then frequently resell.
According to the report, the insidious AIO bots that hackers deploy are multi-function tools that enable quick purchases by leveraging credential stuffing and a number of evasion techniques. A single AIO bot can target more than 120 retailers at once.
Media & entertainment properties are notable credential abuse victims as well, according to the report. Their value is in the personal information those sites maintain. End users share credit card information and demographic data when they sign up for over-the-top (OTT) online streaming services, for example. This type of data has high value on the black market. Akamai also noted significant numbers of credential abuse attacks against financial services, hotel and travel, and consumer goods sites.
The techniques change, but the motivation remains the same: greed, said Martin McKeay, Security Researcher and Editorial Director of the State of the Internet / Security report. Retailers remain on the front lines, because stolen merchandise sells quickly and at a premium. And for that reason, the data shows which merchandise is of the highest value: Apparel sites are targeted the most.
Within the retail industry outside of the apparel vertical, Akamai tracked credential stuffing attempts against direct commerce, department stores, office supply stores, and fashion, such as jewelry and watches.
API Traffic Prevalence and Potential IPv6 Underreporting Point to Security Concerns API calls represent 83 percent of web traffic, according to an October 2018 Akamai traffic review detailed in the report. The majority of API traffic is for custom applications, which is the result of digital transformations and cloud-based application deployment. For security teams, growth in API volume is important when considering risk, because some security tools are not equipped to manage API traffic.
The state of web applications is fluid, and many API calls are application or company-specific and require a different security approach than HTML traffic, which is seemingly static, McKeay explained.
Meanwhile, DNS traffic analysis outlined in the report notes that IPv6 traffic might be underreported, since many systems capable of IPv6 usage still prefer IPv4. This could indicate device misconfiguration or improper monitoring and network blind spots, a security concern. Since IPv6 is still believed to be a minority of web traffic, it is not a major selling point for a number of security tools.
A complimentary copy of the 2019 State of the Internet / Security: Retail Attacks and API Traffic report is available for download here. For additional information about credential abuse-specifically credential stuffing-and advice for organizations facing these types of attacks, visit here. For information about other Akamai solutions, including for DNS security, visit here.
Methodology The Akamai 2019 State of the Internet / Security: Retail Attacks and API Traffic report combines attack data from across Akamai's global infrastructure and represents the research of a diverse set of teams throughout the company. The report provides analysis of the current cloud security and threat landscape, as well as insight into attack trends using data gathered from the Akamai Intelligent Platform. The contributors to the State of the Internet / Security Report include security professionals from across Akamai, including the Security Intelligence Response Team (SIRT), the Threat Research Unit, Information Security, and the Custom Analytics group.
About Akamai Akamai secures and delivers digital experiences for the world's largest companies. Akamai's intelligent edge platform surrounds everything, from the enterprise to the cloud, so customers and their businesses can be fast, smart, and secure. Top brands globally rely on Akamai to help them realize competitive advantage through agile solutions that extend the power of their multi-cloud architectures. Akamai keeps decisions, apps and experiences closer to users than anyone - and attacks and threats far away. Akamai's portfolio of edge security, web and mobile performance, enterprise access and video delivery solutions is supported by unmatched customer service, analytics and 24/7/365 monitoring. To learn why the world's top brands trust Akamai, visit www.akamai.com, blogs.akamai.com, or @Akamai on Twitter.
###
Most recent headlines
05/01/2027
Worlds first 802.15.4ab-UWB chip verified by Calterah and Rohde & Schwarz to be ...
07/10/2026
Dalet, a leading technology and service provider for media-rich organizations, today announced the latest Long-Term Supported (LTS) release of Dalet Flex. Build...
06/09/2026
June 9 2026, 23:00 (PDT) Dolby and MagentaTV Bring Fans Closer to the FIFA Worl...
20/08/2026
Share
Copy link
Facebook
X
Linkedin
Bluesky
Email...
20/08/2026
Share
Copy link
Facebook
X
Linkedin
Bluesky
Email...
20/08/2026
Share
Copy link
Facebook
X
Linkedin
Bluesky
Email...
20/08/2026
Share
Copy link
Facebook
X
Linkedin
Bluesky
Email...
20/08/2026
IPC Expands Brazilian Presence with New Channel Partner CCATech
Industry veterans Carlos Abrah o and Bruno Lopes strengthen local support and expand IPCs prese...
20/08/2026
Zixi Enters Mauritius Market Through Strategic Deployment with MTC Jockey Club
Worlds Oldest Horse Racing Club in the Southern Hemisphere Selects Zixis Softwar...
20/08/2026
LA JOLLA, CA-Scripps Research assistant professor Tiantian Liu has received a five-year NIAID DP2 award from the National Institute of Allergy and Infectious Di...
20/08/2026
Audiences reveal appetite for multicultural Australia on-screen 20 August 2026
Dr Georgie McClean, Dr Rebecca Huntley (L-R)
By Dr Georgie McClean and Dr Rebec...
20/08/2026
How Mavis Studio Is Expanding Live Production Teaching at Sussex
Brie Clayton August 19, 2026
0 Comments
Hero image displays a student about to mix be...
20/08/2026
Vertical Unscripted Series Legal Queens Captured with Blackmagic Design
Brie Clayton August 19, 2026
0 Comments
Reality TV veteran Eric Gardner create...
19/08/2026
As the cost of IP nears price parity with traditional SDI, Reynolds argues that ...
19/08/2026
A private 5G bubble was chosen instead of traditional broadcast RF for the race ...
19/08/2026
(L-R) Rafael Manuel and Isabel Sicat attend the Filipi ana premiere during the 2026 Sundance Film Festival at The Ray Theatre on January 23, 2026, in Park Cit...
19/08/2026
Studio owners invited to have their say on rates cuts
The Music Producers Guild (MPG) are inviting UK-based studios to take part in an in-depth survey that ...
19/08/2026
Vintage-inspired desktop interface revealed
Harrison's latest hardware offering sees them head into the world of audio interfaces, delivering a 10-in/12...
19/08/2026
Granular effect remains locked to scale and tempo
Described as your dream granular effect , Minimal Audio's latest creation is capable of turning any s...
19/08/2026
First polyphonic SWAM instrument incoming
Audio Modeling's latest physical-modelling orchestral instrument is just around the corner, and is now availab...
19/08/2026
World Cup Games Generate 84 Billion Minutes Across FOX, Fox Sports 1 and NBCU...
19/08/2026
July brought typical peak-holiday drops in viewership, driven primarily by viewers stepping away from screens and a visible decline in reach across both traditi...
19/08/2026
Share
Copy link
Facebook
X
Linkedin
Bluesky
Email...
19/08/2026
Henry joins BCE as the company accelerates its commercial strategy and expands its international presence across the media, broadcast and technology markets. He...
19/08/2026
iWedia, a leading provider of software solutions for connected TV devices, today announced a major milestone in Android platform optimization with the successfu...
19/08/2026
NTP Technology announces that ST 2110-30 audio-over-IP connectivity with AES67 and RAVENNA capabilities is now available for the brand's world-class audio i...
19/08/2026
Net Insight has been selected to provide its Nimbra platform by the service provider Big Blue Marble, formerly ORS Group, as the core media transport solution f...
19/08/2026
LiveU has supported Coventry City FC and several other top-flight UK football clubs through one of their most demanding live production challenges of the year, ...
19/08/2026
Nature Seekers Documentary Shot with Blackmagic URSA Cine 12K LF
Brie Clayton August 18, 2026
0 Comments
Filming endangered turtles required camera...
19/08/2026
Neyrinck Brings D-Control Consoles Back to Life on Apple Silicon with D-Control ...
19/08/2026
Share
Copy link
Facebook
X
Linkedin
Bluesky
Email...
19/08/2026
Share
Copy link
Facebook
X
Linkedin
Bluesky
Email...
19/08/2026
Share
Copy link
Facebook
X
Linkedin
Bluesky
Email...
19/08/2026
Share
Copy link
Facebook
X
Linkedin
Bluesky
Email...
19/08/2026
Share
Copy link
Facebook
X
Linkedin
Bluesky
Email...
19/08/2026
Riedel Communications today announced that Edith Cowan University (ECU) in Perth, Australia, implemented a comprehensive communications infrastructure that brin...
19/08/2026
QuickLink, a leading provider of award-winning video production and remote guest contribution solutions, will spotlight a major leap forward in remote guest con...
19/08/2026
Integrated platform melds media asset management, playout automation and newsroom workflows
EMAM, PlayBox Neo and SNEWS have officially launched Nuvex, a conne...
19/08/2026
Screen Australia releases the Private Investment Toolkit to strengthen screen in...
19/08/2026
Do Aussies truly value local content? Unpacking Screen Currency 2026 with Deirdr...
19/08/2026
There's an early Christmas gift for Bookish fans, as UKTV confirms the re-commission of the hit U&alibi drama, created by and starring Mark Gatiss. Viewers ...
19/08/2026
Wednesday 19 August 2026
Sky gives sports fans the chance to watch multiple liv...
19/08/2026
On Saturday September 5 Katie Taylor will step into the ring for the fight of her life against Flora Pili in front of 80,000 fans in Croke Park. A legendary fig...
18/08/2026
SportStream 2026, a free three-day virtual event, will take place September 15-17. One registration provides access to all three days of live programming and on...
18/08/2026
BeckTV will introduce BeckFlow to the European market at IBC2026, demonstrated on the Providius stand (10.F53).
BeckFlow is a web-based schematic documentation...
18/08/2026
Boland Communications will introduce a SMPTE ST 2110 input option for its 4K monitors at IBC2026, along with a new 55-inch super-narrow bezel display for video ...
18/08/2026
Dolby Laboratories and the Seattle Seahawks have announced a partnership integrating Dolby OptiView into the Seahawks' live streaming coverage, making the S...
18/08/2026
For BMG Executive Producer of Sports Production, Graham Taylor, producing live s...
18/08/2026
TMRW Sports has appointed Rufus Hack as President of Golf, a newly created role in which he will lead the company's golf businesses including TGL presented ...
Akamai State of the Internet Security Report: Retailers Most Common Credential Stuffing Attack Victim; Points to Dramatic Rise in API Traffic as Key Trend 
