Holiday deals can really be hiding hacker surprises