Recent cyber security incidents against major retailers highlighted the threat facing the retail sector: fashion retailer ASOS , Phase Eight, Hobbs, Whistles, and a separate hacking claim under investigation by H&M. While each incident differs, the incidents highlight how cyber criminals are continuing to actively target retailers’ systems, putting customer data, digital services and brand reputations at risk, suggests AJ Thompson, Chief Commercial Officer at Northdoor plc.
The IT services firm says that retailers must treat cyber security as a fundamental business priority, combining technical protection with tested recovery plans and, critically, communication with customers, employees and other stakeholders.
Thompson, pictured, said: “The frequency and seriousness of the cyber security incidents impacting retailers should act as a wake-up call for the entire sector. The very nature of the data held by retailers makes them attractive targets. Cyber criminals fully understand the commercial pressure that comes with disrupting online sales, accessing customer data or damaging a trusted brand. They are constantly on the lookout to exploit weaknesses in technology, compromised credentials or vulnerabilities in third-party services to gain access.
“Even where the full impact is still being investigated, the business must manage the immediate operational and reputational consequences. ASOS provides an important example of the communications challenge. When customers receive an unexpected and alarming notification through a retailer’s own app, the usual boundaries between a technical security incident and customer experience disappear. People want to know whether their information is safe, whether the message is genuine and what they should do next.
“Good communication must be supported by the right foundations. Security controls must extend to suppliers and connected platforms, because an organisation’s exposure does not stop at the boundaries of its own network.
“Equally, retailers need to plan for the possibility that their normal systems will be unavailable. That means having tested incident response and recovery arrangements, clear decision-making responsibilities and alternative ways to communicate with customers if standard channels cannot be trusted.
“With such a sophisticated threat facing the sector, some retailers are turning to IT consultancies to help test that they can maintain essential services and recover after an attack. No organisation can promise that it will never experience a cyber-attack. The priority is to make attacks harder to execute, identify them earlier, contain their impact and recover with as little disruption as possible. Retailers that combine preventative security with operational resilience and effective communication will be better positioned to protect their customers and maintain confidence when an incident occurs.”
