Are Retailers Shopping for a Cybersecurity Breach?

Have you ever walked into your favorite store or restaurant, and when you tried to finalize your purchase, you were told that they could not process any credit cards? Have you ever thought that this might be the result of a successful breach and not because of a point-of sale (POS) malfunctioning? What would the consequences be if such an event were to happen on Black Friday, Cyber Monday, or during the holiday shopping season?

Retailers started the century as the prime targets for cyber attackers looking for credit card data. But negative blowback from major breaches in the 2000s, fines imposed by regulators, and strict cyber security mandates such as PCI-DSS, helped retailers dramatically improve cyber security and slow down the wave of attacks.

Today, unfortunately, retailers are again coming back to the spotlight. Attackers are no longer focusing solely on credit data, but target rich amounts of sensitive personal data on retailer’s systems or introduce ransomware for a quick payout that doesn’t even require data exfiltration. The 2022 Thales Data Threat Report: Retail Edition, finds that 45% of retail respondents reported that the volume, severity and/or scope of cyberattacks had increased in the previous 12 months.

The retail edition of the annual Thales Data Threat Report was created considering a subset of the 2,700 global respondents who identified themselves as employees of retail organizations, including grocers, restaurant and food service, as well as “classic” retailers.

Human errors, malware and ransomware threats make a bad recipe

Similar to many organizations, 36% of retail respondents cited human error as the leading threat. Of the leading perceived threats, malware tops the list at 65%, and ransomware follows close behind at 52%. Of course, the common attack method is phishing, and its related form, whaling. One shocking statistic is that, even though 55% of the retailers had experienced a breach, only 33% of retailers prioritized multi-factor authentication (MFA) as the most effective method for preventing cyberattacks.

Fortunately, 59% of retail organizations are using MFA, however, only 8% of the respondents use modern authentication for on-premises apps and only 20% deploy it to protect the majority of cloud-based applications. Modern MFA is cost-effective, easy to implement, and is so much more secure, that one has to wonder why this has not been a priority for retailers.

Cybersecurity breach statistics to destroy your appetite"

One of the most alarming findings include the fact that 33% of retailers have experienced a breach in the previous twelve months. But that is not all, only 48% of retailers have a formal ransomware plan, while 27% indicated a willingness to pay the ransom.

Complexity is another problem. 68% of retail respondents identified their Infrastructure as-a-Service (IaaS) environments as multi-cloud, and the same percentage (68%) said they have over 25 Software as-a-Service (SaaS) applications in use, leading to potential issues with the complexities of securing multiple cloud environments.

A visible consequence is that only 46% have complete knowledge or are very confident they know where their data is stored. Another consequence is that 59% of retailers reported having five or more key management solutions, leading to increased vulnerabilities and cybersecurity challenges.

Despite the above findings, retailers are pretty serious about the security of their businesses. For example, 29% of retailers reported that they have adopted and are actively embracing formal zero-trust strategies, just like any other industry. In addition, another 53% is either planning or considering the adoption of a zero-trust approach to securing on-premises, cloud, and remote access management.

Treat your cyber threats like your physical ones

Every year, Black Friday drives an exponential increase in online transactions – making both consumers and retailers a target for scammers and cyber criminals. Retailers are ideal targets due to their size, highly distributed infrastructures, and large quantities of online and in-store credit card transactions. The industry is also heavily dependent on high-value, constantly available systems, making them attractive marks for ransomware during the peak of the holiday season, when any disruption of their systems can cost millions of dollars per hour.

Ahead of this Black Friday, retailers must reassess their cyber security practices to ensure it is robust and resilient enough – not just for the biggest shopping day of the year, but year-round. They should consider the following tips:

1. Assess risk: Educate themselves on the whereabouts of their data and classify it by risk level to ensure sensitive data is sufficiently protected and encrypted.

2. Automate data security governance: The modern complex Hybrid IT infrastructure requires organizations to enforce granular security policies across multiple systems, automation is essential to be able to scale protection and meet compliance requirements.

3. Follow Zero Trust principles: Employ “least privilege” access across the highly distributed, high-value data and assets, both on- and off-premises. By following the principle of “Never Trust, Always Verify”, employees can only access data they're authorized to, while verifying their identity to do so.

4. Implement MFA: Add an extra layer of security, such as two factor or multiple factor authentication, to ensure only the intended individual can access the network.

5. Roll out cybersecurity training: Human error remains the weakest security link across businesses. Create and maintain a cybersecurity awareness training program for all employees so they can competently and confidently navigate risks.

To find out more, and to learn how Thales can help to improve security for your retail organization, read the full 2022 Thales Data Threat Report Retail Edition.