What happened
Reuters reported on October 19, 2026 that a Chinese-speaking hacker broke into the websites of more than 100 companies, including Deere, SharkNinja and Cummins. You can read the Reuters story as SRN News republished it.
The hacker did very little of the work by hand. According to researcher Snorre Fagerland of NorForge, AI agents did almost all of it, spending hours probing sites and breaking in on their own. NorForge's report, Inside Cairn, describes a tool you hand a target and a goal, and it sets agents to look for weak spots and try to get in.
Starting September 25, the hacker aimed the agents at e-commerce websites in the US, Canada, Australia and Japan. That is the part that matters if you sell online. The target list was stores, not only famous brands.
How fast and how cheap it was
By late last week, the agents had tried to break into more than 1,200 sites, Reuters reports. A successful break-in typically took around 23 hours of probing, by Fagerland's estimate.
Fagerland estimated the whole campaign cost roughly $5,000 in AI usage, about $50 for each successful break-in. Those are one researcher's estimates, not a bill anyone has seen.
Put those numbers side by side and an old comfort goes away. A person working by hand has to pick which sites are worth a day of effort. These agents tried more than 1,200 sites, at an estimated $50 for each successful break-in. A small store does not need to be interesting to end up on a list like this. It only needs to be online and taking orders.
What the agents went after
NorForge's report, published October 19, 2026, says the main group's aim appears to be lasting access to e-commerce and payment systems, to cash in on later. In plain words, the goal seems to be getting in and staying in.
The agents also did not stop when the front door held. In one case they found no weakness in a company's main site, so they found a related public control panel and a flaw in how it handled data.
The break-ins were not only at big names. Two smaller businesses also told Reuters they had been broken into. Reuters could not tell how much data, if any, was taken. So do not read this as proof that customer card numbers leaked anywhere. Read it as proof that a lot of doors got tried at once.
How shops often get broken into
The defense here is not new. Adobe's security guide for Adobe Commerce stores says attackers often get in through known flaws that were never patched, poor passwords and loose permission settings. That guide is written for Adobe Commerce, so take it as that platform's advice.
Adobe says installing the latest version and current patches, for the store software and every extension, is the main protection. For any business, the Cybersecurity and Infrastructure Security Agency (CISA) says to turn on automatic updates where you can, in its page on four cybersecurity essentials.
The second fix is about signing in. Adobe says to turn on two-factor sign-in for the store admin. CISA's page on requiring multifactor authentication says to turn it on for email and file storage too. With two-factor on, a stolen password alone does not open the door.
None of this stops an agent from knocking. It closes the doors the agents are looking for, and that is the part you control.
If someone else runs the store for you, ask them two questions this week. When were the store and its extensions last updated? Is two-factor on for every admin login?
What to do
- Update the store software this week, then every plugin and extension, one by one.
- Turn on automatic updates for the store and its extensions wherever the setting exists.
- Turn on two-factor sign-in for the store admin, for every person who has an admin login.
- Turn it on for your business email and file storage as well.
- Write down every subdomain, old test site and admin panel of yours that is still online. Take down the ones you no longer use.
- Change any admin password that is short or easy to guess.
When we build a store, you own the code and the accounts from the first day, as the websites page explains.