INDUSTRY FACT FILE · RETAIL & E-COMMERCE

Five New Case Studies in Retail and E-commerce Security

Original 2026 case studies, each written as a blog post, showing how current threats play out in retail chains, marketplaces, D2C brands and quick-commerce platforms and how Codec Networks services break the attack chain.

In this document 1.  About these case studies 2.  Case Study 1: The Script That Stole the Checkout 3.  Case Study 2: The Festive Sale That Never Loaded 4.  Case Study 3: The Loyalty Points That Walked Away 5.  Case Study 4: The Dark Store That Went Dark 6.  Case Study 5: The Customer File on Sale

These five case studies were written for this document set and have not been published elsewhere. Each is a composite scenario combining attack techniques and control failures widely observed in retail and e-commerce with the obligations that apply in India as of October 2026—in particular CERT-In's Directions and audit guidelines, RBI's payment rules, PCI DSS v4.0.1, the Consumer Protection (E-Commerce) Rules, SEBI disclosure for listed companies and the DPDP Act.

Important disclosure The organisations described are fictional and the scenarios are illustrative. They are not accounts of real incidents, and they are not Codec Networks client engagements or claims of achieved outcomes. Their value lies in showing how connected weaknesses form an attack chain, which controls break it, and which services test those controls.

Case study	Organisation type	Core threat	Regulatory lens	Primary bundles
1. The Script That Stole the Checkout	Online fashion retailer	Payment page skimming through a third-party script	PCI DSS v4.0.1; RBI PA rules; CERT-In	B2, B9, B4
2. The Festive Sale That Never Loaded	Online marketplace	Scalper bots and DDoS during a festive sale	E-Commerce Rules; CERT-In; SEBI (parent)	B1, B3, B10
3. The Loyalty Points That Walked Away	Listed retail chain	Credential stuffing and loyalty redemption fraud	CERT-In; DPDP; SEBI LODR	B1, B7, B8
4. The Dark Store That Went Dark	Quick-commerce platform	Ransomware entering through a franchisee's VPN access	CERT-In; customer and partner contracts; DPDP	B3, B9, B7
5. The Customer File on Sale	D2C consumer brand	Cloud misconfiguration and leaked key exposing customer data	DPDP; CERT-In; E-Commerce Rules	B3, B6, B8

The payment gateway was never breached. The chat widget next to it was.

At a glance
Organisation	A fashion e-tailer (“Shopco A”) selling through its own site and app with an embedded payment page from an authorised aggregator
Threat	A compromised third-party chat widget modified to copy card details typed on the checkout page
Why it is new	Skimming now rides on trusted scripts, and PCI DSS v4.0.1 expects retailers to control them
Codec Networks services	Payment page script review, third-party script risk, PCI DSS readiness (Bundles B2, B9, B4)

The scenario

Shopco A's marketing team added a customer-chat widget to every page, including checkout, by pasting one script tag into the tag manager. Nobody recorded it as a payment page script.

Months later the widget vendor's content delivery account was compromised. The attackers appended a few lines that read card number, expiry and CVV fields as shoppers typed them and sent the values to a look-alike domain. Tokenisation happened afterwards, so the aggregator saw nothing unusual.

The skimmer ran for seven weeks until card networks traced a fraud cluster to Shopco A. The acquirer demanded a PCI forensic investigation, the aggregator suspended settlement pending review, and Shopco A reported the incident to CERT-In and notified customers.

Figure 8: Illustrative attack path for Case Study 1 and the controls that break it.

What went wrong

• No inventory or authorisation of scripts loading on the payment page.
• Card fields were not isolated in hosted or tokenised components.
• No tamper detection on the checkout page.
• The widget vendor had never been assessed for security.

The impact

Shopco A refunded affected customers, paid forensic and acquirer costs, lost weeks of settlement cash flow and saw a sharp fall in conversion while headlines ran. Its aggregator required a full PCI DSS v4.0.1 remediation before restoring normal terms.

The regulatory lens

• PCI DSS v4.0.1: requirements 6.4.3 and 11.6.1 on payment page scripts and tamper detection applied and were not met.
• RBI PA framework: the aggregator's merchant due diligence and incident processes were triggered.
• CERT-In Directions: the incident was reported within six hours of discovery, but logs could not show when the script changed.

How Codec Networks would help

Need	Codec Networks response	Bundle
Control the payment page	Script inventory and authorisation, hosted payment fields, tamper detection design and testing	B2
Assess the scripts' owners	Third-party script and SaaS risk assessment with contract clauses	B9
Prove PCI compliance	PCI DSS v4.0.1 scoping, gap assessment and evidence for the acquirer	B4

Key lessons Treat every script on the checkout as payment code. Isolate card entry and detect tampering. Assess the vendors behind third-party scripts. Keep the evidence PCI DSS and the acquirer will ask for.

The stock sold out in ninety seconds. Almost none of it went to real customers.

At a glance
Organisation	A marketplace (“Martco B”) running its largest annual festive sale with limited-stock smartphones and televisions
Threat	Automated scalping of cart and checkout APIs followed by an application-layer DDoS
Why it is new	Bots and DDoS-for-hire are timed for the days that make a retailer's year
Codec Networks services	API and business-logic testing, bot and DDoS readiness, war-game exercises (Bundles B1, B3, B10)

The scenario

Martco B's app called an add-to-cart API that had no rate limit per device or account. Scalper groups built scripts that reserved limited-stock phones thousands of times a second the moment the sale opened.

Within ninety seconds the hero products showed as sold out. Genuine customers flooded support and social media; some of the reserved stock reappeared on resale channels at a mark-up within the hour.

An hour later an application-layer DDoS hit the search and checkout services. The CDN absorbed the volume but the origin's search cluster failed, and checkout errors continued for most of the day while engineers scaled by hand.

Figure 9: Illustrative attack path for Case Study 2 and the controls that break it.

What went wrong

• No rate limiting or bot management on cart and checkout APIs.
• No pre-season load and DDoS testing of the search and checkout paths.
• Runbooks with the CDN provider were untested and escalation contacts were stale.
• No war room combining engineering, SOC and the CDN partner on sale day.

The impact

Martco B lost a day of its highest-value sales, refunded orders, faced consumer complaints about unfair access to deals and watched competitors run advertising on its outage. Its listed parent recorded the incident in its quarterly disclosure.

The regulatory lens

• Consumer Protection (E-Commerce) Rules: complaints about unfair allocation and failed orders reached the grievance officer and consumer forums.
• CERT-In Directions: the DDoS was reported as a cyber incident within six hours.
• SEBI LODR: the listed parent disclosed the incident in its corporate governance report.

How Codec Networks would help

Need	Codec Networks response	Bundle
Find the logic gaps	API and business-logic testing of cart, stock reservation and checkout	B1
Build for the peak	Bot management, rate limits, CDN and WAF design, load and DDoS resilience testing	B3
Rehearse sale day	Festive war game with engineering, SOC and CDN partner; runbooks and escalation	B10

Key lessons Rate-limit and bot-manage every API behind the app. Load- and DDoS-test the real peak paths before the season. Rehearse runbooks with providers and keep contacts current. Staff a war room on sale day.

Nobody hacked the loyalty platform. They simply logged in.

At a glance
Organisation	A listed grocery and general-merchandise chain (“Chainco C”) with a loyalty app holding points for millions of members
Threat	Replay of passwords leaked from other sites against the app, followed by redemption of points into e-gift cards
Why it is new	Stored value behind consumer-grade authentication is a cash machine for attackers
Codec Networks services	ATO testing, SOC with fraud signals, forensics (Bundles B1, B7, B8)

The scenario

Chainco C's app allowed unlimited login attempts from the same device and did not check passwords against known leaked lists. Attackers replayed millions of credential pairs from other breaches and took over tens of thousands of accounts whose owners reused passwords.

Points were redeemed for e-gift cards delivered to new email addresses added minutes earlier; no step-up authentication protected redemption or contact changes. The gift cards were resold on messaging groups within hours.

Customers noticed vanished points over a weekend. The fraud team saw refund requests; the security team saw nothing, because login telemetry was not monitored. The pattern was understood only when the two teams compared notes on Monday.

Figure 10: Illustrative attack path for Case Study 3 and the controls that break it.

What went wrong

• No rate limits or leaked-credential checks on login.
• No step-up authentication for redemption or contact-detail changes.
• Login and redemption telemetry was not monitored by the SOC.
• Fraud and security teams worked in separate systems.

The impact

Chainco C restored points to every affected member, absorbed the gift card losses, reset millions of passwords, reported the incident to CERT-In and disclosed it under SEBI LODR. Member engagement fell for a quarter.

The regulatory lens

• CERT-In Directions: unauthorised access to accounts reported within six hours of recognition.
• DPDP: account data and contact details of members were affected; breach intimation would apply once the provisions commence.
• SEBI LODR: disclosed in the quarterly corporate governance report.

How Codec Networks would help

Need	Codec Networks response	Bundle
Test the account journey	Credential-stuffing and account takeover testing, redemption logic review	B1
See it in time	SOC monitoring of login, redemption and contact-change anomalies with fraud signals	B7
Understand and report	Forensic reconstruction, CERT-In and disclosure support	B8

Key lessons Rate-limit logins and check for leaked passwords. Require step-up authentication before points leave the account. Monitor login and redemption telemetry in the SOC. Give fraud and security teams one view.

Three hundred dark stores stopped because one franchisee downloaded the wrong software.

At a glance
Organisation	A quick-commerce platform (“Quickco D”) operating dark stores through franchise partners connected to a central WMS and rider dispatch
Threat	Malware on a franchisee laptop used through a standing VPN to reach WMS and order management, followed by ransomware
Why it is new	Dark-store networks multiply partner endpoints with access to the systems every delivery depends on
Codec Networks services	Zero-trust partner access, third-party risk, SOC and backups (Bundles B3, B9, B7)

The scenario

Quickco D gave each franchisee VPN access to its WMS so store staff could receive stock and pick orders. Franchisee laptops were owned by the partners, shared between shifts and outside Quickco D's endpoint controls.

A store manager installed pirated inventory software on one of them. The bundled malware harvested the VPN credentials, and attackers used the tunnel to reach the WMS and order management servers, which sat on the same network as rider dispatch.

On a Friday evening ransomware encrypted WMS, OMS and the dispatch service. Riders' apps showed no orders, stores could not pick, and the consumer app accepted orders it could not fulfil for an hour before being switched off. Deliveries resumed in a limited way after two days of rebuilding.

Figure 11: Illustrative attack path for Case Study 4 and the controls that break it.

What went wrong

• Standing VPN access from unmanaged partner devices.
• Flat network between WMS, OMS and dispatch.
• Backups were online and partly encrypted; restores had never been rehearsed.
• No EDR or SOC visibility on franchisee endpoints or lateral movement.

The impact

Quickco D lost two days of orders across 300 dark stores, refunded customers, paid rebuilding costs, saw customers switch to competitors and faced franchisee claims for lost income. It reported the incident to CERT-In and rebuilt its partner access model.

The regulatory lens

• CERT-In Directions: ransomware incident reported within six hours; logs needed for investigation.
• Partner contracts: franchisee agreements had no security obligations or device standards.
• DPDP: customer addresses and phone numbers in WMS and dispatch were exposed to the attackers.

How Codec Networks would help

Need	Codec Networks response	Bundle
Replace the tunnel	Zero-trust partner access with MFA and device checks; segmentation of WMS, OMS and dispatch; immutable backups and restore testing	B3
Govern the partners	Franchisee and partner risk programme with device standards and contract clauses	B9
Detect early	24x7 SOC with EDR across HQ, stores and managed partner endpoints	B7

Key lessons Never give unmanaged partner devices standing access to core systems. Segment the systems every delivery depends on. Keep backups immutable and rehearse restores. Monitor partner access as closely as your own.

No one broke in. The customer database was simply left on the internet.

At a glance
Organisation	A venture-backed D2C personal-care brand (“Brandco E”) selling through its own storefront and marketplaces
Threat	A publicly readable cloud bucket holding a CRM export and an old API key committed to a public code repository
Why it is new	Fast-growing brands move customer data between tools and agencies faster than they govern it
Codec Networks services	Cloud posture and secrets review, DPDP programme, forensics (Bundles B3, B6, B8)

The scenario

Brandco E exported its CRM—four million customers with names, phone numbers, addresses and order histories—to a cloud bucket for an agency's analytics project. The bucket was set to public to make sharing easy and never changed back.

Separately, a developer had committed a storefront API key to a public code repository a year earlier. Automated scanners found both: the bucket was downloaded, and the key was used to pull recent orders directly from the storefront API.

A seller listed the data set on a forum. Within days customers received messages quoting their real recent orders and asking for a small payment to release delivery, and the brand's support channels filled with complaints.

Figure 12: Illustrative attack path for Case Study 5 and the controls that break it.

What went wrong

• Public cloud storage holding a full customer export.
• A live API key in a public repository with no rotation.
• No data inventory, minimisation or encryption for CRM exports.
• No monitoring of bucket access or unusual API usage.

The impact

Brandco E reported the incident to CERT-In, notified customers, rotated every key, paid for forensic investigation and monitoring, faced investor diligence on security and lost a marketplace partnership pending remediation.

The regulatory lens

• CERT-In Directions: data breach reported within six hours of discovery.
• DPDP: customer personal data exposed; once in force, breach intimation to the Board and affected individuals would apply and retention limits would have required deleting old exports.
• E-Commerce Rules: customer complaints about fraud using order data reached the grievance officer.

How Codec Networks would help

Need	Codec Networks response	Bundle
Fix the foundations	Cloud posture review, secrets management, access and logging for storage and APIs	B3
Govern the data	DPDP programme: data mapping, minimisation, encryption, retention and breach workflow	B6
Investigate and notify	Forensics, dark web monitoring, CERT-In and customer notification support	B8

Key lessons Know every copy of customer data and who can reach it. Scan for and rotate exposed secrets. Minimise, encrypt and expire exports. Monitor storage and API access for bulk retrieval.

Contact Codec Networks Pvt. Ltd. New Delhi: 507, 5th Floor, New Delhi House, Barakhamba Road, Connaught Place, New Delhi – 110001 Gurugram: 707, 7th Floor, Silverton Tower, Golf Course Extension Road, Sector 50, Gurugram – 122018, Haryana Landline: 011 430 496 96 | 011 437 522 99   Mobile: +91 99716 76124 | +91 88007 88220 | +91 88003 31124 Email: mktg@codecnetworks.com   Web: www.codecnetworks.com