One operator steering three AI agents stole 600,000 cards for an estimated $12,000 to $18,000, Gambit says

At one retailer, the site's own deployment replaced the skimmer, and a scheduled job put it back ^[15]. The agents wrote to many layers: they inserted scripts into existing JavaScript files and checkout pages, and also changed database content, cloud storage, cached pages and Kubernetes deployments ^[14]. The RuntimeWire account attributes that spread to the agent adapting to the access and infrastructure it found on each target ^[19].

Each of those layers has its own restore path. Redeploying a clean build from the repository fixes the files that build ships. It does not touch a script stored in a database row or a cached checkout page. If the attacker also controls a scheduled job, that job can reinstall the skimmer after the redeploy, as it did at that retailer ^[15].

The RuntimeWire write-up says the incident shows why teams must measure how quickly critical systems can be restored, and not only whether backups exist ^[16]. I agree, with a narrower definition of restored for a checkout. In my view the drill's clock should stop only when every layer the attacker could write to matches a known-good state. For this campaign that list includes scheduled jobs, object storage, page caches, and live Kubernetes specs compared against version control.

The cost figures are Gambit's estimates. An OpenRouter account showed $7,005.71 in spending over about four weeks as of August 25, and Gambit extrapolated $12,000 to $18,000 from later usage in the agent logs ^[3]. The attacker's own cost review averaged $25.46 across 101 completed scans, with single scans between $3.13 and $79.31 ^[13]. Those 101 scans come to about $2,570 ^[3]. Spread over more than 600,000 cards, the full estimate is 2 to 3 cents a card ^[2]. RuntimeWire notes the figures are not an audited accounting of the operation ^[13].

For that per-card figure to transfer to another attacker, the human input has to transfer too. The evidence does not show an unattended attack. Gambit found 1,951 prompts across 260 Hermes sessions, many of them short requests to inspect a vulnerability report, try a route into an admin panel or carry on after gaining access ^[6]. Hermes ran Anthropic's Opus 4.6 through OpenRouter and carried 121 skills, 78 of them attack-related, under a persona named "SOUL - Red Team Operator" ^[4][5]. The job title, at least, is accurate. The estimate is built from OpenRouter spend and agent-log usage ^[3], so it measures model calls. The operator's hours are not in that basis.

The tooling supplied the volume. From August 23 to 31, Strix ran 146 times against 138 hosts for 633 hours of scanning ^[7], about 4.3 hours a run ^[4]. Between September 10 and 15 the attacker launched 105 attack projects, and Gambit says at least 27 companies were compromised to varying degrees in that window ^[8].

The 119-site figure is BleepingComputer's. Gambit's report describes 19 confirmed skimmer installations among 27 named targets, plus more than 100 additional infected sites associated with the campaign ^[9]. The stolen cards came from two companies ^[10]. Overwatch Data counted 488,372 US-issued cards, 79% of the total ^[10]. That puts the total near 618,000 ^[1]. The victims were not named. Gambit described them as including a Fortune 500 hospitality company, a major US airline, a large industrial-supplies distributor and an online fashion retailer ^[11].

The evidence comes from a staging server run by the attacker, which Gambit's researchers accessed ^[17]. Gambit sells Balens, a platform designed to map infrastructure and validate recovery paths ^[18], so the recovery conclusion and the vendor's product point the same way. The company calls the report interim and warns that the agents' own logs can be wrong, though it says researchers verified substantial parts of them against direct evidence ^[17].