Q3 2026 Threat Intelligence Report (ungated)
In Q3 2026, a cluster of criminal marketplaces collapsed and tracked listings still rose 52% as sellers rebuilt elsewhere. Identity data exposed in 40+ incidents fed a market where every input to a KYC check is for sale, and AI lowered the cost of each stage of the attack. The holiday season will start well before Black Friday.
What the data says ahead of the holiday season
What changed in 2026
924K+
Automated checkouts claimed in monitored communities this quarter, across 710+ retailers. 36% were collectibles.
+52%
More tracked marketplace listings by September, after a cluster of marketplaces collapsed in August. Half of the sellers who reappeared were trading on a new platform within 18 days.
<$100
To build a synthetic identity that can pass onboarding checks. A clean ID match no longer proves a real customer.
What does this mean for your business?
About the data
Quick answers about the Q3 report
More reports
Q3 2026 Threat Intelligence Report
In Q3 2026, a cluster of criminal marketplaces collapsed and tracked listings still rose 52% as sellers rebuilt elsewhere. Identity data exposed in 40+ incidents fed a market where every input to a KYC check is for sale, and AI lowered the cost of each stage of the attack. The holiday season will start well before Black Friday.
Read more
Q2 2026 Threat Intelligence Report
Explore the Q2 2026 threat intelligence landscape: AI-accelerated fraud, credential markets, and adversary economics — and how our 2026 predictions are tracking
