1 in 8 retailers faced a cyber-attack in the last 12 months according to data published in a report by Grant Thornton. With just 46% of retail businesses having a cyber strategy in place - below the global average (52%) for all businesses.
Cybercriminals have a particular interest in the retail sector due to the high volume of customer data that is collected and stored, particularly through online and eCommerce shopping platforms.
In 2018, fashion retailer SHEIN suffered a data breach that affected over 6.4 million customers. Cybercriminals were able to gain access to the company’s servers and steal the personal information of SHEIN’s customers. The breach occurred in June, but the company only discovered the incident in late August.
No retail business is too big or too small to consider its cyber security strategy, whether you have 50 customers or 100,000, the data you retain on your customers and staff is of huge value to a cyber-criminal.
Why should retail and eCommerce businesses be aware of cyber attacks?
A recent report released by SonicWall, showed cybercriminals have increased their attacks on the retail sector over the past 12 months, with a 264% surge in ransomware attacks on eCommerce and online retail businesses.
This report highlighted that the UK market is vulnerable to the ongoing threat of ransomware attacks, which disrupt supply chains and cause widespread system downtime, financial loss and reputational damage for businesses. In the UK, ransomware attacks have increased by 227% overall; of those, one in every five attacks targeted online retail businesses (21%).
Further research by PwC on their client base revealed that cyber-attacks on their retail clients had increased by over 30%, showing that the retail and eCommerce industry is of interest to cybercriminals.
Within only a few months, the pandemic accelerated the shift of the public shopping online via eCommerce stores by five years, meaning there is now more public and private data stored in the cloud than ever before.
In the two years from March 2019 to March 2021, there was an 8% increase in the opening of retail businesses. And, with 98% of UK businesses now operational online in one way or another, benefiting hugely from the use of websites, social media, staff email addresses, online banking, and the ability for customers to shop online, it is no surprise that cybercrime has followed this trend upwards.
What type of attacks do retail and eCommerce businesses face?
Five top tips to protect your online store from cyber attacks
Business owners should make sure they understand the risks associated with running a retail or eCommerce store. To help, we’ve created five top tips for you to take to help protect your business from cyber-attacks.
1. Double up with Two-factor Authentication
Two-factor authentication (also known as 2fa, two-step verification or multi-factor authentication) is designed to help stop cybercriminals from accessing your accounts even if they obtain your passwords.
Two-factor authentication (2fa) ensures that any new device trying to log in or make account changes needs a second layer of security before access is given. 2FA includes single-use codes being sent via SMS, email, phone, or smartphone application.
Turn on 2FA for your email system and social media accounts via the links below.
2. Store your passwords securely and make sure they are strong
Your first level of protection when securing your online accounts or customer data is a strong password. Whilst complex passwords can be difficult to remember, (which often leads to people choosing weaker passwords or repeating them) the National Cyber Security Centre (NCSC) encourages businesses to use three random words; such as HouseForestFlower to help protect against common issues like brute force attacks. This is where an attacker tries many passwords with the hope of guessing them correctly.
The aim of a strong password is not to make it so you won’t remember it, but so cybercriminals struggle to crack it. Another tip is to include symbols, capital letters and numbers to make it even more secure.
3. Regularly backup your data
You rely on business-critical data, such as customer details, quotes, orders, payment details or coursework/examination files (for education establishments). How long you would be able to operate without them?
All businesses, regardless of size and type, should take regular backups of their important data, and make sure that these backups are tested so you are confident they can be restored.
Ransomware (and other malware) can often move to attached storage automatically, which means any such backup could also be infected, leaving you with no backup to recover from. To help keep your files and data safe, you should secure digital backups with a password or encryption and keep them isolated from your network.
By doing this, you're ensuring your business can still function following the impact of flood, fire, physical damage, or theft. Furthermore, if you have backups of your data that you can quickly recover, you can't be blackmailed by ransomware attacks.
4. Remember your updates
Every piece of software your business uses whether this is payment transaction software or a digital stock management system offers the potential for unauthorised access and exploitation.
Keep computers, devices, applications, and software patched and up to date, and where you can, add the use of two-factor authentication with strong passwords.
Regularly patching and installing software updates helps to protect your devices as the updates will expose new flaws and vulnerabilities. Cybercriminals use these flaws and vulnerabilities to attack your devices and steal your identity. Software and app updates are designed to fix these weaknesses and installing them as soon as possible will keep your devices secure.
5. Pay attention to the details
Human error is one of the main contributing factors to the majority of cyber security breaches, a recent IBM report showed that 95% of cyber security breaches are primarily caused by human error.
Whilst people can often be the weakest link in the chain, if educated they can become your strongest asset in protecting your business. Cybercriminals will try to lure in your employees by clicking on an infected link in an email or opening the infected email itself (a phishing email).
The key to security awareness training is to equip all your employees with a level of awareness to combat these threats. Employees need to be taught what clues to look for that indicate threats, and how to respond when they see them.