Crook uses open-source AI tools to break into 27 companies

A cybercriminal deployed three open-source AI agents to break into multiple organizations, including a Fortune 500 hospitality company and a major US airline, stealing hundreds of thousands of credit card records. The attacks spanned several days and affected a mix of industries, with victims ranging from large corporations to online retailers.

What happened

Security researchers described a campaign where an operator used three open-source AI tools to automate intrusions into numerous companies. The method involved staging access on an operator’s server and using AI-enabled techniques to probe networks, extract payment card data, and install card-skimming capabilities. By mid-September, at least 105 attacks had been launched and data from about 27 companies showed varying levels of compromise.

Who is affected

Victims include a Fortune 500 hospitality company, a major US airline, a large private US industrial supplies distributor, and a US online fashion retailer. The exact extent of each company’s breach varies, with some reporting stolen card details and others noting broader access. At least 600,000 card records are cited as affected in the reporting, though the total impact across all victims may be higher as not all incidents are fully disclosed.

Practical next steps for businesses and consumers

For businesses: review access controls around AI-assisted tools, monitor for unusual credential use, and audit payment systems for skimming indicators. If you detect or suspect card compromise, follow standard incident response procedures and notify affected customers. For consumers: monitor card statements for unfamiliar charges, report suspected fraud to card issuers, and consider enabling additional card security features such as virtual cards or transaction alerts. If you have been a victim, coordinate with your bank or card issuer for replacement and ongoing monitoring. No specific customer advisories are provided beyond general breach notification best practices in the source material.

Limits and questions

The source describes the nature of the attacks and affected organizations but does not provide detailed technical diagrams or a full list of all victims. It also does not specify the names of the Fortune 500 hospitality company or the airline. Ongoing investigations may reveal more precise victim counts and remediation steps. Readers should await official statements from affected companies and law-enforcement updates for definitive guidance.

Information and responsibility notice: This article is general information based on the cited material available when published. It is not legal, tax, immigration, medical, financial, banking, or investment advice; it does not create a professional-client relationship; and it is not a guarantee of outcome, availability, accuracy, or eligibility. Rules, schedules, prices, and third-party information can change. Confirm material decisions with the relevant authority and an appropriately qualified adviser before acting.