The wave of cyberattacks on UK retailers has highlighted just how much damage these incidents can cause. An attack on Marks & Spencer in April forced the retailers to suspend online orders for almost seven weeks. An attack on Co-op saw customer data stolen and shelves left bare. Parag Jain, Executive Vice President Manufacuring & Consumer Services, Chief Growth Officer at Zensar Technologies, explores the threats which retailers face and what solutions are on offer.
The impact of the recent wave of cyberattacks on UK retailers was plain to see – not just for the businesses which were hit, but for people across the country.
Empty shelves were reported at Co-op stores nationwide, some of which were only able to accept cash payments in the initial aftermath of a cyberattack against the retailer’s IT systems.
Just days previously, Marks & Spencer was forced to suspend online orders as it reacted to a cyberattack, which like Co-op, resulted in empty shelves in stores. It was reported that the immediate aftermath of the attack cost Marks & Spencer millions of pounds a day due to lost sales.
The luxury department store, Harrods, was also hit by a cyberattack during the same period.
Speaking at the CyberUK conference in Manchester, just days after the attacks, government minister, Pat McFadden, said they should serve as a wake-up call for businesses ‘that cybersecurity is not a luxury but an absolute necessity’.
This is especially true for retailers, which as recent events have made clear, are particularly reliant on systems being fully operational to provide customers with fresh food and other essential everyday items.
The threats
Cybercriminals know this, which is why ransomware gangs prey on high transaction environments like retail; they know that uptime is crucial – and that if the critical systems are down because they’ve been encrypted with ransomware, a retailer can lose millions a day in lost transactions.
It’s why retail makes such an appealing victim for ransomware attacks. When faced with disrupted systems, customers unable to make purchases and the business losing vast sums of money each day in lost sales, some companies choose to pay cybercriminals ransom demands of millions to receive the decryption key to restore systems, despite warnings from authorities that this only encourages further ransomware attacks and other crimes.
Attackers can achieve similar results with a Distributed Denial of Service (DDoS) attack – in this case, they simply overwhelm the retailer’s website and systems with traffic. Sometimes these attacks are conducted just because someone wants to disrupt a business – but it’s known for attackers to hit victims with a DDoS attack and only stop after extorting a ransom payment.
But it isn’t just the way retailers provide vital services to people which make them such a tempting target for cybercriminals. Customers are providing retailers with vast amounts of personal information – including names, dates of birth, addresses, emails, passwords and banking or credit card details – all of which can be valuable if cybercriminals can gain access to networks or databases and steal it from retailers.
In this scenario, hackers can sell the information to other cybercriminals on the dark web or they could try to exploit it themselves. Either way, leaked information puts both the business and its customers at additional risk from theft and fraud – and there’s a high chance that customers could lose trust in a retailer they perceive to have not protected their personal information responsibly.
The solutions
The wave of incidents has highlighted the threat of cyberattacks against retailers and the widespread disruption they can cause. But it must also act as an opportunity for the wider retail industry to reflect on cyberthreats and how to improve cybersecurity practices and safeguards.
Having Endpoint Detection and Response (EDR) tools in place to identify compromised devices is a good starting point, as having this can go a long way to detecting phishing links, malware or other malicious activity before it starts to become a problem.
However, attackers don’t necessarily need malware to compromise a network. The rise of remote working and cloud applications allows employees to login to their corporate accounts from anywhere.
But this also provides an avenue for attackers to exploit: be it because they’ve stolen login credentials, used a brute-force attack to breach commonly used or simple passwords, or even posed as IT support staff to trick employees into resetting passwords –which is how the attacks targeting Marks & Spencer and Co-op started.
No matter how they’re acquired, because the attackers are using legitimate login credentials it’s harder to detect illicit activity.
There are steps which retailers can take to counter this threat, such as proactive network traffic analysis to detect unusual behavior from accounts, alongside log analysis to trace unauthorised access, especially from unusual sources.
A Zero Trust approach to security, where inherent trust is removed in favour of verifying if the user is legitimate at every step of the process, while it could be perceived as frustrating for employees, also goes a long way to protecting those employees, the retailer and customers from the threat of cyberattacks. And one way of helping to achieve this is by applying multi-factor authentication to accounts, especially those with administrator level privileges.
Investing these sorts of defences is vital to ensure the security of retail organisations; but it’s also important for these businesses, as high-profile, high-value targets of cybercriminal gangs to also be proactive in defence.
They should be reviewing threat intelligence to understand the latest trends, techniques and vulnerabilities exploited by attackers to have the best chance of defending against them. Retailers could even go further by reverse engineering malware to understand its scope and intent and what they need to do to bolster their network resilience.
Because in this arena, cyberattackers are constantly evolving it’s vital that retailers know what they’re potentially facing – especially as cybercriminals move to embrace AI-powered attacks.
With their high transaction volumes and sensitive customer data, retailers are prime targets for cyberattacks, as demonstrated by the recent string of incidents. Therefore, investing in cyberinfrastructure and cyberawareness must be a top priority.
Every attack is a call to improve, and organisations should simulate breach scenarios, review incident response protocols and update Business Continuity and disaster recovery plans. If not, they might be the next high-profile victim and risk compromising customer trust and losing vital income.
