TL;DR
- 61% of retail and ecommerce organizations experienced an identity-based event. Among affected organizations, 52% experienced operational downtime and 48% reported fraud or unauthorized transactions.
- Exposed or compromised non-human identities (NHIs) were retail’s leading initial access vector at 28%. Among affected organizations, 44% cited exposed, compromised, or overprivileged NHIs as a common access path.
- 48% cited phishing or social engineering as another common access path, while 46% cited stolen session cookies or tokens.
- Improving collaboration across IT, identity and access management (IAM), security, and fraud teams was retail’s leading priority, selected by 38%.
Source note: Unless otherwise noted, findings in this article are based on SpyCloud’s 2026 Identity Threat benchmark research — a survey conducted in June 2026, that was the basis for the 2026 SpyCloud Identity Threat Report.
Across SpyCloud’s 2026 Identity Threat benchmark research, 61% of retail and ecommerce organizations reported an identity-based event during the previous year, compared with 68% across all industries. But when events did occur, affected retailers reported higher rates of downtime and fraud than organizations overall.
A recent ecommerce incident shows how quickly trusted third-party access can become a customer and operational issue. In September 2026, compromised API credentials belonging to third-party applications on BigCommerce were used to inject malicious scripts into merchant storefronts, and shopper data was accessed in at least one affected environment.
Retail identities connect storefronts, payment operations, customer accounts, fulfillment systems, and vendor portals, so one exposed credential, session, or API key may require several teams to respond.
Machine and vendor identities can carry trusted access outside the retailer’s direct control, while stolen sessions can preserve access after login. Once attackers are in, workforce and customer exposure can intersect. Reducing the risk requires teams to understand what was exposed, where that identity can go, and how to remove the access before it affects transactions or operations.
Fewer retail organizations reported identity events, but those affected reported more downtime and fraud
Retail systems tie identity access to sales and customer service, allowing an identity event to move quickly from a security issue into an operational or financial problem.
Affected retailers report high rates of downtime and fraud
experienced productivity or operational downtime, compared with 39% overall.
experienced fraud or unauthorized transactions, compared with 40% overall.
faced regulatory or legal consequences, compared with 38%
experienced a loss of customer or partner trust.
Downtime can stop transactions, delay orders, and disrupt fulfillment, while fraud creates an immediate financial consequence. Compared with the cross-industry picture in SpyCloud’s 2026 identity threat findings, the retail results tie identity security closely to operational resilience and customer protection. That makes how attackers get in especially important, and one access point stands out above the rest.
Machine and vendor identities carry trusted access outside the retailer’s direct control
Retailers rely on ecommerce integrations, payment services, logistics providers, marketplaces, automated workflows, and supply-chain partners. These relationships introduce non-human identities such as API keys, service accounts, bots, tokens, and application credentials.
NHIs are retail’s leading initial access vector
identified exposed or compromised NHIs as their single most common initial point of entry.
selected stolen session cookies or tokens, compared with 16% overall.
selected exposed or weak credentials, compared with 14% overall.
Their role does not end at the initial point of entry. Once exposed, they can reach applications, data, shared platforms, retailer portals, and operational workflows.
Retail identity events frequently involve NHI and third-party access
cited exposed, compromised, or overprivileged NHIs as a common access path.
cited third-party or supply-chain exposure as a common access path.
experienced misuse of NHIs such as AI agents, bots, or service accounts.
experienced API key compromise or misuse, compared with 27% overall.
experienced a third-party or supply-chain identity event, compared with 27% overall.
Because machine credentials don’t sign in the way people do, controls tuned to human behavior may miss their misuse. Retail teams need a clear inventory of the non-human identities attackers can target, along with visibility into third-party and vendor exposure. Without a named owner, an exposed API key or service account can stay valid long after it appears in data from the criminal underground.
Stolen sessions can turn trusted retail access into fraud and disruption
Successful phishing and infostealer malware can expose active session cookies and tokens on managed or personal devices. Among affected retail and ecommerce organizations, 48% cited phishing or social engineering as a common access path, compared with 37% overall. Another 46% cited stolen session cookies or tokens, also compared with 37% overall.
Multi-factor authentication (MFA) can stop a stolen password from being enough to log in, but it does not prevent an attacker from replaying a valid session cookie or token stolen after authentication. Attackers can use that session to enter an authenticated employee or customer account without supplying the password or completing a new MFA challenge. For a retailer, that access could reach a customer’s loyalty balance and stored payment methods or an employee’s pricing and order-management tools.
Password resets may leave that access intact when active sessions or refresh tokens remain valid. Session Identity Protection helps identify stolen authentication material, and SpyCloud’s session hijacking guide covers the wider detection and prevention process. Closing the access requires terminating sessions, revoking refresh tokens, and forcing reauthentication.
Retail identity threats can put workforce systems and customer accounts at risk
Non-human identities and stolen sessions can expose many of the same workforce and customer systems that keep retail running. Those systems connect employees, contractors, customers, and the applications, automated systems, and partners. Once inside, an attacker’s next move depends on which identity was exposed.
Workforce or partner access can reach the systems behind customer accounts, transactions, inventory, fulfillment, and ecommerce administration, while exposed customer credentials and sessions can lead to account takeover, unauthorized purchases, loyalty fraud, and abuse of stored payment methods.
After identifying retail identity exposure, trace it across:
- Identity: Which customer, employee, contractor, vendor, or machine identity is affected?
- Authentication: Are any associated sessions or refresh tokens still active?
- Account: Have contact, recovery, delivery, or payment details changed?
- Transactions: Is there unusual purchase, refund, gift card, or loyalty activity?
- Operations: Can the exposed identity alter pricing, inventory, fulfillment, payment, or customer account settings?
Workforce exposure and customer exposure meet when attackers use internal access to reach customer data, or use exposed customer identities to commit fraud. Earlier visibility into exposed customer credentials and sessions gives retailers a chance to protect an account before suspicious login or transaction activity appears.
Compromised identities can escalate into ransomware, insider misuse, and account takeover across the business
Identity exposure can provide the starting point for several types of retail security events. Among affected organizations, 44% experienced ransomware enabled by a compromised identity, compared with 40% overall. Another 40% experienced insider threat or employment fraud involving identity misuse, compared with 36% overall. Employee or contractor account takeover affected 36%, and 20% experienced a hijacked session, compared with 16% overall.
Each outcome pulls in a different combination of teams. A ransomware investigation typically starts with security and incident-response teams. Insider misuse may involve fraud, legal, or human resources, while account takeover can require identity and access management, fraud, and digital operations to act together. Removing the identity access path associated with ransomware or account takeover therefore depends on signals and response actions moving across organizational boundaries.
Continuous vendor identity exposure monitoring
SpyCloud Supply Chain Threat Protection monitors vendor employee domains against recaptured breach records, infostealer logs, phishing captures, and combolists, surfacing active identity exposure across third-party ecosystems rather than relying on static vendor risk scores. The Supply Chain Threat Protection overview explains how that approach helps teams identify active identity risk across vendor ecosystems.
Retail security teams are prioritizing cross-team coordination around identity exposure
Improving collaboration across IT, IAM, security, and fraud teams was retail leaders’ top priority for the next 12–18 months. 38% selected it, compared with 29% overall.
An exposed identity may first appear in security intelligence before fraud or digital operations teams see suspicious activity. The signal has to travel between teams to be useful. IAM can remove access, security can investigate the exposure, fraud can review accounts and transactions, and digital operations can protect customer-facing services.
Retail’s priorities combine better visibility with faster response
prioritize improving malware visibility and response, compared with 29%
prioritize automating identity-related incident-response workflows, compared with 35% overall.
prioritize reducing employee and contractor identity exposure, compared with 31%.
prioritize faster remediation of credentials, sessions, tokens, and API keys, compared with 30% overall.
- 59% have visibility into vendor exposure but no consistent process to confirm remediation, compared with 40% overall.
- 38% have visibility and actively confirm remediation, compared with 59% overall.
- 3% report having no visibility into vendor identity exposure.
Connecting exposure data to fraud decisions gives the teams involved a common starting point for access removal, transaction review, customer protection, and operational recovery.
Find exposed identities before they affect retail operations
Search your domain for compromised credentials and other identity data that may provide trusted access.
Complete remediation depends on the identity asset exposed
Different identity assets require different responses, and a password reset addresses only one of them.
Match remediation to the exposed identity asset
- Password: Reset it and check for reuse across connected accounts.
- Session cookie or refresh token: Invalidate the session, revoke the token, and require reauthentication.
- Malware exposure: Identify the credentials, sessions, application access, and identity data taken from the affected device.
- API key or service account: Rotate the secret, review privileges, and update dependent applications.
- Third-party identity: Confirm that the vendor addressed the exposed identity, device, session, or access.
In supported directory environments, Identity Guardians can automate credential and session remediation based on approved policies.
Every workflow should end with verification that the compromised access no longer works. Closing a ticket without that confirmation can leave the attacker’s original route into an account, application, or retail system open.
4 ways retailers can reduce time between identity exposure and exploitation
Retailers can shorten exposure windows by coordinating protection across workforce, customer, machine, and third-party identities.
4 ways retailers can reduce time between identity exposure and exploitation
Retailers can shorten exposure windows by coordinating protection across workforce, customer, machine, and third-party identities.
1. Expand monitoring beyond workforce passwords
Monitor customer and workforce credentials alongside session cookies, refresh tokens, malware-exfiltrated data, and exposure tied to personal devices. Connect each exposure with the accounts, applications, and commerce environments it could affect.
2. Assign ownership to machine and third-party identities
Inventory API keys, service accounts, application credentials, and vendor identities with access to retail systems. Assign an owner, review privileges, and establish who must act if that access becomes exposed.
3. Revoke compromised sessions alongside resetting passwords
After terminating the session and revoking its refresh tokens, review other applications connected to the affected user or device. Apply reauthentication or additional controls when the exposed identity presents greater account or transaction risk.
4. Connect identity exposure signals across response teams
Define who owns access removal, transaction review, customer protection, and operational recovery. Automate approved actions where possible while preserving oversight for decisions that affect customers or critical systems. SpyCloud’s guide to account takeover prevention offers additional insighst for employee and customer accounts.
Protecting trusted access helps protect retail operations and customer accounts
An exposed retail identity can affect systems across checkout, fulfillment, and customer accounts, so the response may span more than one team. Retailers can limit identity-driven fraud and downtime by identifying what attackers stole, understanding the access it provides, routing the response to the right team, and confirming that the access is gone.
The full 2026 SpyCloud Identity Threat Report covers the cross-industry findings behind these retail comparisons.
Benchmark retail identity defenses against the wider market
FAQs
Identity threats in retail and ecommerce involve exposed or compromised identity assets that attackers can use to gain trusted access. These assets include employee and customer credentials, session cookies and tokens, API keys, service accounts, third-party identities, and other non-human identities (NHIs).
Retailers connect ecommerce integrations, payment services, and logistics providers to their environments through API keys, service accounts, bots, and other NHIs. In SpyCloud’s 2026 Identity Threat benchmark research, retailers identified exposed or compromised NHIs as their leading initial access vector, ahead of stolen session cookies and exposed credentials.
Stolen session cookies can provide access to authenticated employee or customer accounts without requiring a password or new multi-factor authentication (MFA) challenge. Password resets may not remove access provided by active sessions or refresh tokens.
SpyCloud’s 2026 Identity Threat benchmark research found that 61% of retail and ecommerce organizations experienced an identity-based event during the previous year, compared with 68% across all industries. Affected retailers reported higher rates of downtime and fraud than organizations overall.
Exposed credentials and authenticated sessions can give attackers access that retail systems already trust. Such access may enable employee or customer account takeover, unauthorized transactions, loyalty fraud, or entry into systems that handle customer and payment data.
Retailers can monitor credentials, sessions, malware exposure, NHIs, exposure tied to personal devices, and third parties; share exposure information across response teams; match remediation to the exposed asset; and verify that access has been removed.
Keep reading
