Retail stores are one of the oldest ways humans exchange goods and services, and they have evolved tremendously over recent years. One of the most significant shifts they have undergone is the dramatic increase in technology integration within its operations.
From tools to check stock to staffing management and cash registers, retail stores rely heavily on technology for almost every aspect of their business.
The sheer number of transactions they do, coupled with the amount of customer data they hold, it’s no wonder how they’ve become prime targets for cyber attacks.
Retail is one of the fastest-growing categories in terms of cyber attacks, having seen a 117% increase in attacks in 2021. Not only do that, but they also see the whole gamut and experience a wide variety of cyber threats.
This article will explain why this sector sees increased cyber threat activity, analyze its different attack vectors, and provide tips for retail stores to protect themselves better.
The Cyber Threats and the Retail Industry
With nearly a quarter of all cyber attacks directed at retail stores, it’s fair to say that companies in this industry need a robust cyber security plan to keep the company’s and users’ sensitive user and payment data safe.
Data breaches seem to be the most common end goal for retail cyber attacks, leading the industry to have the third highest rate of data breaches in 2022 behind healthcare and education.
While most attacks end up only exposing basic personal identifiers like names and other personal information, the situation can quickly deteriorate if the victim has poor password hygiene.
And severe attacks where payment information is exposed are on the rise. Hackers broke the defenses of Target in 2013, exposing 41 million payment cards and the personal information of 70 million customers.
Home Depot was hit with malware affecting 52 million customers’ payment information in 2014, and an attacker managed to steal the credit card information of 4.6 million Neiman Marcus customers in 2021.
Why is retail a good target for cyber attacks?
With so many high-profile cyber attacks against retail stores, it’s important to know why hackers seem to prefer them. Retail stores across all industries often have the perfect storm of large amounts of recorded payment information, a varied third-party vendor roster, and a high turnover rate.
This means retail stores have extremely valuable information stored on an incredibly difficult-to-secure system. The high turnover can be especially dangerous since it leads to improper cyber security awareness training, making retailers vulnerable to phishing attacks.
How Cyber Criminals Target Retail
Source: Positive Technologies
While some industries, like healthcare, see mostly ransomware attacks, the retail sector has to stay on its toes at all times and on all fronts. Since retailers use a myriad of hardware and software technology, the number of vulnerabilities ends up being very high within these stores.
Phishing
Phishing can be particularly successful against retail stores because workers often don’t have dedicated work emails and don’t use them in their day-to-day activities. Emails are then often used in situations where workers are unfamiliar with basic phishing detection.
From ordering stock to dealing with logistic partners, links leading to external sites are the norm for retail stores. Hackers have become masters of disguise and can easily fool a distracted worker.
Malware
The Home Depot attack mentioned above happened precisely because their POS system was infected with a malware program designed to steal credit card information as transactions were processed. The breach took several months to be noticed and affected millions of customers.
Retail store devices such as cash registers and POS systems have undergone significant evolution to the point of becoming mini-computers running semi-traditional operating systems that can be infected.
Additionally, the increased internet connectivity of these devices makes them an easier target for hackers.
Ransomware
These are the types of attacks retailers see the least, but they can still be crippling to a large network of stores. Larger retailers often keep stores by country or district on the same payment or cash register system to make the IT departments’ jobs easier.
This means a ransomware attack can leave a retailer unable to take card payments or record transactions if the target is the cash register system. Cyber criminals can then rely on the urgency of the situation to get the victim to pay them to resume their operations.
Third-Party Risk Management for Retailers
Source: Gartner
Third-Party Risk Management (TRPM) is a framework used to assess the risk level related to dealing with various exterior vendors, suppliers, technology platforms, and contractors. It can be employed to evaluate all kinds of processes, but it is especially crucial when it comes to cyber security.
Retail companies often have 5 to 10 technology partners to run their stores. While this allows them tremendous efficiency gains, all these external players can quickly become weak points if they haven’t been properly assessed.
The two biggest breaches in recent events, previously mentioned Target and Home Depot hacks, resulted from improper TRPM strategy.
TRPM best practices
Identifying potential TRPM risks is one thing; maintaining standards for all third-party vendors is another.
Make sure it’s more than a basic inspection, and try to collaborate directly with your partners to develop cyber security awareness programs for your staff geared explicitly towards your needs.
The main danger of third-party software and hardware vendors is that employees are often unfamiliar with them. This means they aren’t properly trained to detect when a software is infected or running erratically.
Another potentially dizzying aspect of TRPM is that each hardware vendor has its own supply chain of vendors and partners. For example, a certain type of chip or operating system could be infected and lead to a breach. This is where constant communication with technology partners becomes essential for retail IT departments.
Cyber Security Awareness is the Answer
The common thread for all retail cyber attacks is the wide variety of technology used at nearly all stores worldwide. Since retailers have high turnover rates, they often skip cyber security training for their employees to save time. However, the opposite should be true.
Because employees are always on the front lines of unfamiliar systems and situations, they must be part of an especially robust cyber security awareness program. It should be built in collaboration with all your technology partners, with dedicated sections on each technology used.
Even when all parties involved do their job to stay secure, your employees will always be the first line of defense. If they are well equipped and trained, they’ll be able to detect issues ahead of time and potentially save your customers from a sticky situation.
5 Steps to Masterminding an Effective Security Awareness Program
If you need some tips to kickstart your cyber security awareness program, watch this video.