A Chinese Hacker Used AI To Attack 100+ Companies In One Of Largest AI Hacks Yet

A Chinese-speaking cybercriminal used AI agents to target as many as 100 organisations, exposing more than 600,000 credit card records. That’s according to a Forbes investigation drawing on research from cybersecurity firm Gambit Security. The activity ran over roughly five days in September.

Forbes reports the attacker accessed at least 30 websites between September 10 and 15. The hacker used an older version of Anthropic’s Claude alongside Chinese AI models from DeepSeek and Moonshot AI’s Kimi, with open-source orchestration tools helping automate much of the campaign. The incident points to a growing concern: AI can cut the time, cost, and expertise an operation like this normally requires.

One attacker, a hundred targets

According to Gambit’s research, the attacker could direct AI agents toward different targets and let the systems handle much of the technical work, adapting the approach for each organisation rather than running one identical process everywhere.

That changes the economics. Forbes reports the whole campaign cost around $8,000, with per-target costs ranging from roughly $3 to $180. Traditional campaigns usually need whole teams for reconnaissance, vulnerability research, and exploitation. AI agents can now handle chunks of that work in parallel, with far fewer people involved.

Anthropic’s latest threat-intelligence report describes the same pattern across the industry. The company says bad actors increasingly use AI as an orchestrator rather than just a chatbot, letting one attacker coordinate far more targets without growing a human team to match.

More than 600,000 card records on the attacker’s server

Forbes reports the attacker’s server held information on at least 618,000 credit cards. Overwatch Data, which analysed the records, found strong evidence the data was unique and legitimate. Roughly 488,000 of those cards reportedly belonged to Americans.

Having the data doesn’t mean criminals used all of it successfully. Investigators couldn’t confirm whether the attacker had already drained funds or made purchases, and researchers were still notifying affected companies when the story was published. Still, the risk is real: one payments processor told Overwatch Data that at least 60% of the cards it checked hadn’t previously been flagged for fraud, suggesting much of this data was genuinely new to fraud-detection systems.

Different AI models, working together

A striking detail here is the mix of AI systems involved. The attacker combined an older Claude version with DeepSeek and Kimi, spreading tasks across different models and tying them together with open-source orchestration tools. That means a cybercriminal doesn’t need one model capable of running an entire operation. They can stitch together several systems, each handling a piece of the puzzle.

That’s a real problem for AI providers, since safeguards built around one model won’t necessarily stop a campaign that switches to a different service when it hits a wall. Anthropic’s September threat report makes the same point: security can’t focus on locking down one model in isolation when attackers operate across platforms, mixing models and access routes.

Anthropic shut the account down.

Anthropic confirmed it identified and banned the account tied to this campaign, according to Forbes. DeepSeek and Moonshot hadn’t responded to Forbes by the time of publication.

There’s an encouraging detail too. Forbes reports logs showed newer Claude models blocking some of the attacker’s attempts, suggesting updated safeguards stopped at least some overtly malicious activity, even as the attacker kept using an older, less-protected version elsewhere. Anthropic’s threat report says it has disrupted numerous malicious operations involving Claude and tightened safeguards accordingly. Those controls help, but this case also shows why determined attackers tend to hop between models rather than stick to one.

Who’s behind it remains unknown.

Nobody has identified the person running this campaign. Forbes describes the operator only as a Chinese-speaking hacker, stopping short of naming them as a confirmed Chinese national or state actor.

Researchers also think the activity may still be ongoing. Gambit found the attacker accidentally exposed their own infrastructure, giving investigators access to logs, AI tooling, and stolen data. Cloudflare has since taken steps to shut down infrastructure tied to the campaign, though the attacker apparently just set up new servers afterwards.

Big companies and small ones alike got hit.

The reported victims span several major industries. Forbes said the exposed data pointed to an American hospitality company with more than $10 billion in annual revenue, a major U.S. airline, and an online fashion retailer bringing in over $1 billion a year. Smaller businesses showed up among the targets too.

That spread matters. AI-enabled attacks don’t need to focus only on the biggest enterprises anymore, since automation makes smaller targets economically worthwhile when attackers no longer need much human labor per campaign. Anthropic frames this as a narrowing gap between well-funded cyber operations and less-resourced attackers, since AI now offers access to capabilities that used to require a much bigger specialist team.

The math behind cybercrime is shifting

The most important part of this story might not be the card count. It might be the cost of reaching so many targets in the first place. Cybercrime has always been a numbers game, balancing infrastructure and expertise against the value of whatever gets stolen. AI changes that math: automated systems grind through repetitive work at machine speed and adapt their approach across targets without much extra effort. That combination could push more attackers toward higher-volume campaigns against organizations that wouldn’t have been worth targeting before.

For banks and payment companies, this hits especially close to home. Payment data remains one of the most valuable things a criminal can steal, and financial firms depend on sprawling networks of merchants and processors. An attacker doesn’t need to breach a bank directly to cause damage. A single weak spot at a connected merchant can expose payment data that eventually costs someone else in the ecosystem, and AI speeds up how fast criminals can find those weak spots. Financial institutions likely need to strengthen not just their own defenses but also how closely they monitor third-party systems.

Humans are still calling the shots, and the industry is responding

None of this means AI decided on its own to attack these companies. Forbes reports a human operator picked the targets and directed the campaign, with AI agents carrying out the technical work underneath. Anthropic draws a similar line: even highly automated operations still involve humans making key decisions, like picking targets and deciding what to do with stolen information. The real risk comes from human intent paired with increasingly capable automation. AI multiplies what an attacker can pull off; it doesn’t become the attacker itself.

AI companies are responding. Anthropic says it has expanded monitoring, account enforcement, and information sharing after investigating cases like this one. OpenAI recently rolled out a framework for reporting model misalignment and unauthorized behavior. Cybersecurity firms are pushing back too: Palo Alto Networks, for instance, recently launched an AI-powered service built to continuously hunt for vulnerabilities using multiple AI models at once. The same technology fueling more capable attacks is increasingly becoming part of the answer to them.

Why this case matters

This campaign shows how fast AI-enabled cybercrime is evolving. An unidentified operator appears to have stitched together several AI systems and agent frameworks to hit a large number of organizations within days. Researchers recovered data tied to more than 600,000 credit cards, though the full scope of successful breaches is still unclear.

It also exposes a real gap in how people think about AI safety: attackers don’t necessarily need the newest or most capable models to do damage. Older models, open-source tools, and a handful of systems working together can still produce a highly scalable operation. For banks, retailers, and payment processors, that makes old assumptions about attacker resources less reliable, and it will likely take stronger monitoring, faster disclosure, and real collaboration between AI companies, cybersecurity firms, and financial institutions to keep pace.

The investigation is still ongoing, and the full impact on affected organizations remains unclear. But one thing is already obvious: AI isn’t just changing how companies build and defend software. It’s changing how fast cybercriminals can scale an attack.

AI agentsAI CybercrimeAI cybersecurityAI-Powered CyberattackArtificial IntelligenceClaude AICredit Card SecurityCybercrimeCybersecuritydata breachDeepSeekFinancial SecurityfintechKimi AIPayment Security