Cyber Security in the Retail Sector

Retailers can’t afford downtime; they need to showcase, sell and deliver their goods whenever and wherever their customers want to shop, whether that’s on the high street, in retail parks, through their website or via a smartphone, smartwatch or any other mobile device.

The risk of a cyber-attack disrupting sales or delivery systems could be hugely damaging for any retailer – if consumers can’t buy when they want, they simply go elsewhere. Any breach that means IT systems are shut down indefinitely might result in significant revenue losses and financial costs to a brand. There’s also the risk that customer data is stolen, which will inevitably lead to reputational damage. It can take years for a brand to build its reputation, but one single incident to ruin it in a flash.

With the cost-of-living crisis putting extra pressure on household finances, consumers are cutting back on spending in some areas of the retail market. This means every sale counts – retailers need to be open for business as much as possible.

Financially motivated cybercriminals know that retail chains, which store large amounts of customer data, need to keep their doors open for business every day. This makes them a prime target for ransom fees. If a threat actor were to breach an organisation, steal data and encrypt an IT system (double extortion) with the threat of leaking or selling that data unless a ransom fee is paid, how long could the business operate before going under?

Challenges facing retailers

Economic headwinds, including rising rents, business rates and interest rates and decreasing consumer spending power are just some of the challenges facing companies doing business in the sector today. With more people struggling to pay their bills, shops are seeing more thefts in-store. They can ill afford to fall victim to a malicious ransomware attack or have their own employees, who often know how to navigate internal systems better than cybercriminals, steal data from their employer.

Furthermore, as employees in the sector work in so many locations – in offices, in stores and on the move – and with the high turnover of staff in frontline roles in stores, the risks of individuals clicking on a phishing email are greater than in many other sectors.

Many retailers are quickly moving to the cloud – often to multi-cloud environments – which reduces their fixed costs. However, in this new environment they’re introducing new risks because IT and cyber security teams often find it challenging to keep up with the accelerating rate of change in cloud technology. 

But today a growing number of business leaders are realising that it’s not if an organisation will suffer a cyber-attack, but when. They are also beginning to address the little-discussed problem of insider risks. Whether intentionally or unintentionally, individuals are leaking company data. This can happen because of disgruntled staff members thinking that the company owes them something, departing staff stealing data to take to their new employer, or simply confidential data being emailed to the wrong recipient. Whatever the reason, early prevention is better than a fix when it comes to cyber security and data security.