Your homepage gets attention. The support site, the event microsite, and the landing page a vendor built three campaigns ago probably do not.
That gap just got more expensive. On October 19, 2026, Reuters reported that a single hacker handed almost all of the work to AI agents and broke into websites belonging to more than 100 companies, including Deere, SharkNinja, and Cummins. The agents had tried more than 1,200 sites. A successful break-in took about 23 hours of automated probing, and the researcher who watched it estimated the whole campaign cost roughly $5,000 in AI usage, or about $50 per site breached. Reuters could not establish how much data, if any, was taken.
Look at which sites were hit. SharkNinja said the attack reached a standalone site carrying product support information. Cummins said it was investigating a possible attack on a website run by one of its third-party vendors. Deere said it had taken remediation steps and saw no sign that sensitive information was accessed.
The security firm behind the research, NorForge, published its own account the same day. The busiest group fed its agents lists of real shopping sites with 200,000 to 1.5 million visits, already checked by automated browsers to confirm that orders could be placed, and told them to find a way in and leave a quiet foothold for later. NorForge put the average success rate at around 10%. One break-in it confirmed ran through old framework code on a parts vendor's site. Dark Reading reported that the campaign concentrated on e-commerce and payment systems across the U.S., Canada, Australia, and Japan.
The cost of trying every door just collapsed
Attackers used to spend scarce human time on targets worth the effort. When an agent can work a site for a day and a successful break-in costs about as much as a team lunch, every forgotten site becomes worth a try. A 10% success rate is a poor result for a person and an excellent one for software that never gets bored.
This campaign aimed at online stores. The pattern is broader. The sites that fell were not the flagship domains with full-time teams watching them. They were the side doors: a support site, a vendor-run property, older code nobody had touched in a while.
Marketing launched a lot of those doors. Event sites, product microsites, regional landing pages, campaign builds, a careers site an agency set up, a demo environment a partner hosts. Each one carries your brand. Many collect names and emails. Some sit on software nobody has updated since launch.
Your security team defends. Marketing has to know what exists.
You do not need to become a security expert to act on this. You need to answer a question that most marketing leaders cannot answer today: how many websites carry our name, and who owns each one?
Start with a simple register. For every site, record:
- The address, including old campaign domains you still renew.
- A named owner inside the company, not just the agency that built it.
- Who runs it, your team or a vendor, and what the contract says about updates and breach notice.
- What it collects, from form fields to payment details.
- When it was last updated, and whether anyone still uses it.
Then sort the list into three groups:
- Keep and maintain: sites that drive pipeline or serve customers. Each gets an owner and a regular update schedule, agreed with whoever handles security.
- Fold in: content that belongs on your main site. Move it, redirect the old address, and shut the old build down.
- Retire: finished campaigns and dead microsites. Take them offline, keep the domain if you need it, and point it somewhere safe.
Put it in the vendor contract
When an outside firm runs a site with your brand on it, its security is your reputation. Two of the three named companies in the Reuters story pointed to a vendor-run or standalone site. Before your next renewal, ask every agency and platform partner three things: who patches the site and how often, how quickly they will tell you about a suspected break-in, and what happens to the site and its data when the engagement ends.
Collect less, too. A microsite that asks for a phone number, company size, and budget is a richer target than one that asks for an email address. If a field does not change what you do next, drop it.
This week
Ask your web, IT, and agency partners for every domain and subdomain that carries your brand, including the ones you pay to renew but no longer use. Put a named owner next to each live site. Mark the ones nobody claims for review, and schedule the retirements before the end of the quarter. Share the list with your security lead so they know what they are defending.
The main site will always get your attention. The forgotten ones are where someone else will find a way in.
