UK shoppers heading online for Black Friday and Christmas will be buying from websites that cyber criminals have spent the year mapping. Data from SonicWall reveals a sharp escalation in attacks on the digital shop windows of British retailers, with criminals systematically probing the e-commerce sites, order portals and customer-facing web forms that hold shoppers’ personal and payment details.
SonicWall’s monitoring across its specialised network-perimeter sensors in UK retail environments recorded 23.2 million high and medium priority Intrusion Prevention System (IPS) events and 399,530 malware threats between January and September 2026.
Every storefront is being tested
The peak trading quarter accounted for nearly half (48 per cent) of last year’s attack volume, so the busiest weeks for shoppers are also the busiest for attackers hitting retailers. On an annualised basis, intrusion attempts against UK retailers are running roughly 169 per cent above 2025 full-year totals.
Web application attacks make up 97 per cent of that activity and were recorded on 72 per cent of monitored sensors. Criminals are mapping the sector’s customer-facing infrastructure broadly, looking for any way into the data behind the shop front.
Directory traversal is the dominant technique, generating 10.5 million hits – 45 per cent of all IPS volume – across 56 per cent of sensors. These attacks try to trick a web server into handing over files it should never expose, such as configuration files and stored records. Those files can include the credentials that guard customer databases, putting names, addresses, order histories and account details at risk.
More key intelligence:
41 per cent of sensors recorded attempts to exploit a React Server Components remote code execution flaw, which affects the modern web frameworks behind many new storefronts and shopping apps. A successful attack can hand criminals control of the server running the site.
Cross-site scripting: 1.6 million hits. These attacks inject malicious code into web pages, a common route to skimming card details or hijacking customer sessions at checkout.
Log4j still in play: 263,000 hits. More than four years after the flaw was disclosed, targeting unpatched Java systems in retailers’ back-end infrastructure.
SonicWall’s threat research indicates that criminals are mapping the retail sector’s web estate ahead of peak trading, seeking any gap that could lead to stolen customer data, payment fraud, or a site outage at the worst possible moment.
“Our data this year shows a clear pattern: silent reconnaissance against financial services, relentless stress-testing of healthcare, direct extortion against manufacturing, and now a full-scale mapping of Britain’s digital high street,” said Spencer Starkey, executive vice president, EMEA, SonicWall.
“Every one of these attacks is chasing the same prize: the names, addresses, passwords and card details customers hand over every time they shop online. A retailer’s website is its till, and criminals are testing every lock on it before the busiest trading weeks of the year. In the Golden Quarter, nobody wants to take a checkout offline to patch it. Criminals know that. When a breach happens, it’s the customer who pays the price in fraud, phishing scams and lost trust.”
Share