How Retailers Can Combat The Rising Cyberthreat

Uploaded on 2025-06-24 in TECHNOLOGY--Resilience, FREE TO VIEW

In recent months, several well known retailers have made headlines after suffering from cyber attacks. M&S suffered costly disruption that has wiped millions off its value, whilst Harrods and Co-op were also forced to temporarily pause online operations.

It appears as though UK retailers are under attack like never before. But why are retailers so vulnerable? And how can businesses ensure that they are prepared if they become the next target?

Retail’s Cyber Vulnerability

These high profile attacks have forced retailers to come to a security reckoning. Cyber criminals are not only becoming more sophisticated, they are increasingly targeting big name brands to garner the maximum amount of attention. Retailers are clearly not prepared.

Abdelkader Keddari, VP Global Presales at Fluent Commerce, believes that part of the problem is that retailers still rely on legacy infrastructure that is unable to cope when a cyber attack happens. “The continuous high-profile cyberattacks on major UK retailers have exposed the harsh reality that many still rely on outdated legacy systems which leave them vulnerable and slow to respond,” he explains. “When trust is breached, particularly where customer data is concerned, the damage to brand reputation and revenue can be severe.”

He adds: “No retailer is immune either. Smaller businesses often lack the resources for advanced cybersecurity, while larger organisations, which handle vast amounts of data, are the most attractive targets. The shift to online retailing has only widened the attack surface, with phishing, ransomware and payment system breaches on the rise.”

Shobhit Gautam, Staff Solutions Architect, EMEA at HackerOne also believes that a widened attack surface is a big contributor to the rise in attacks. He explains that: “The surge in attacks can be attributed to the growing dependence on digital systems, combined with the comparatively lower commitment to security measures and tools.”

He also notes that “retail websites and mobile apps often mirror each other in both design and backend infrastructure, even right down to shared APIs and business logic. This creates a perfect storm. A single vulnerability, whether in a discount code workflow or a third-party plugin, can be exploited across platforms. I frequently see the same insecure patterns replicated across retailers, particularly where off-the-shelf e-commerce platforms or widely used integrations are involved. The result is a broad attack surface with common weak points, which are something threat actors are quick to exploit.”

Investing In Cyber Resilience

With the risks clear, it’s vital that retailers are shoring up their cyber defences. “These latest cyberattacks also highlight the importance of basic cyber hygiene as hackers accessed North Face systems via credential stuffing, where usernames and passwords stolen from another data breach are used,” says Darren Thomson, Field CTO EMEAI at Commvault. “By never reusing passwords and using secure password managers, these attacks can be avoided. From an organisational perspective, anomaly detection and early warning systems are essential. Knowing as soon as something out of the ordinary is happening within your systems enables security teams to isolate the environment and stop bad actors in their tracks before they have the opportunity to encrypt, steal, or remove access to critical datasets and systems.”

He continues: “Achieving enterprise-grade cyber resilience is more than building taller walls or deeper moats. It requires a new approach that looks holistically across the entire landscape, from best-in-class data protection and security to AI-powered data intelligence and knowing your Minimum Viable Company to allow lightning-fast recovery.”

Glenn Akester, Technology Director for Cyber Security & Networks at Node4 points out that “these latest hits suggest that many retailers still lack the resilient cybersecurity foundations and operational readiness needed to withstand this new breed of threat.”

He argues: “It’s time to stop thinking about cybersecurity as a checklist of tools and start thinking about it as a resilience strategy. Building resilience means assuming that something will get through eventually, and making sure your business can detect it, contain it, and recover quickly. This starts with understanding your risk surface, continuously monitoring for threats, testing and simulating attacks, and finally, having a clear and effective response plan.”

Investing In The Future

These attacks have made clear that cybersecurity and operational resilience are not issues retailers can afford to ignore any longer. Retailers need to be prepared for an attack - and they should ensure their tech stack is modernised and able to cope with such disruptions.

Fluent’s Keddari explains that “to stay resilient, investment in technology like cloud-native Order Management Systems and Distributed Order Management (DOM) is essential. These systems provide real-time visibility, scalability, and intelligent routing - all of which are essential during a cyber incident to maintain continuity, protect customer data, and ensure orders are fulfilled securely.”

He concludes: “Operational resilience also depends on more than tech or security – it’s about smarter decision-making and building flexibility into your operations in order to minimise impact, recover fast, and continue delivering on customer promises when systems are under threat. It is all about being ready to pivot when the unexpected hits. Then you’ll be ready for the next wave of cyberattacks.”

Image: Ideogram

You Might Also Read:

The Future Of Passwords In Retail:

If you like this website and use the comprehensive 7,000-plus service supplier Directory, you can get unrestricted access, including the exclusive in-depth Directors Report series, by signing up for a Premium Subscription.