When Cyberattacks Cost Less Than Coffee, Everyone Is a Target

A hacker attacked 100 companies in five days.

Total cost: about $8,000. Less than half a million pesos.

Per company, as little as $3. The price of a cup of coffee.

This happened this month. The attacker gave AI agents a list of company websites and told them to find a way in. The AI did the rest: it probed each company separately, broke into at least 30, planted hidden code on their checkout pages, took more than 600,000 credit card numbers, and erased its tracks.

The victims included a major airline and a global hotel group. They also included a small gun shop and a beauty retailer.

The attack was only discovered because the hacker made a careless mistake.

Here is what this means in plain terms.

Being too small to notice no longer protects you. When an attack costs $3, every company is worth attacking.

Your IT team is now defending against a machine that doesn't sleep, doesn't get bored, and tries every door.

And "we haven't been hacked" may simply mean "we haven't found out yet."

In my experience, I learned that the most dangerous incident is the one you have convinced yourself cannot happen. We didn't wait for the fire before running the drill.

If you lead a Philippine enterprise, five things to do this quarter:

→ Ask IT one question: if someone tampered with our payment page tonight, how soon would we know?

→ Rehearse a breach. Under the Data Privacy Act, you have 72 hours to notify the NPC. Know who calls whom.

→ Check your suppliers. The attacker told the AI to look for weak links in the supply chain.

→ Make cyber risk a standing board agenda item, not a line in the IT report.

→ Stop treating security as a cost to trim. The attacker's budget just fell to near zero. Yours cannot.

AI will change how we build businesses. It has already changed how they are attacked.

CEOs and board directors: when did your board last discuss cyber risk as a strategic issue rather than a technical update?