Meta: This article covers the latest trends in retail cyber security, common vulnerabilities, and best practices to safeguard against data breaches.
Retail stores are one of the oldest ways for humans to exchange goods and services, and it they have evolved tremendously over recent years. One of the biggest shifts they have undergone is the dramatic increase in technology integration within its operations.
From tools to check stock to staffing management and cash registers, retail stores rely heavily on technology for almost every single aspect of their business. Coupled with the sheer amount of transactions they do and amount of customer data they hold, they have become prime targets for cyber attacks.
Retail is one of the fastest growing categories in terms of cyber attacks, having seen a 117% increase in number of attacks in 2021. Not only do they see a large amount of cyber attacks, they see the whole gamut and experience a wide variety of cyber threats. This article will explain why this sector sees increased cyber threat activity, analyze its different attack vectors and provide tips for retail stores to better protect themselves.
With nearly a quarter of all cyber attacks being directed at retail stores, it’s fair to say this industry needs to have a robust plan in place to maintain their security around the sensitive user and payment data they routinely collect.
Data breaches seem to be the most common end goal for retail cyber attacks, leading the industry to have the third highest rate of data breaches in 2022 behind healthcare and education. While most attacks end up only exposing basic personal identifiers like names and other personal information, the situation can quickly deteriorate if the victim has poor password hygiene.
And severe attacks where payment information is exposed are on the rise. Hackers broke the defenses of Target in 2013, exposing 41 million payment cards and the personal information of 70 million customers. Home Depot was hit with a malware attack affecting 52 million customers’ payment information in 2014, and an attacker managed to steal the credit card information of 4.6 million Neiman Marcus customers in 2021.
With so many high profile cyber attacks against retail stores, it’s important to know why hackers seem to prefer them. Retail stores across all types of industries often have the perfect storm of large amounts of recorded payment information, a varied third party vendor roster and a high turnover rate.
This means retail stores have extremely valuable information stored on an incredibly difficult to secure system. The high turnover can be especially dangerous since it leads to improper cyber security awareness training, making the retailers vulnerable to all types of phishing attacks.
While some industries like healthcare see mostly ransomware attacks, retail really has to stay on its toes at all times and on all fronts. Since retailers use a myriad of hardware and software technology, the number of vulnerabilities ends up being very high within these stores.
Phishing can be particularly successful against retail stores because workers often don’t have dedicated work emails and don’t use them in their day to day activities. Emails are then often used in situations were workers are unfamiliar with basic phishing detection.
From ordering stock to dealing with logistic partners, links leading to external sites are the norm for retail stores. Hackers have become masters of disguise and can easily fool a distracted worker who recently started the job.
The Home Depot attack previously mentioned happened precisely because their POS system was infected with a malware program designed to steal credit card information as transactions were processed. The breach took several months to be noticed and led to millions of customers to be affected.