Case Study: The Cookie Privacy Monster in Big Global Retail

A case study summarized by The Hacker News describes how Reflectiz discovered that a major retail client had 37 domains injecting cookies without user consent via iFrames hidden by the company VPN; the data was being sent to a legitimate third‑party advertiser rather than a malicious actor. The issue was a configuration and monitoring gap rather than an attack, but it created significant GDPR non‑compliance risk and potential fines, and the report emphasizes the need for continuous monitoring, improved interdepartmental communication, and visibility into third‑party code.