Retail & cyber risk: taking back control

The past year has brought an unsettling reminder of the fragile state of cybersecurity in the global retail industry. A growing number of cyberattacks have compromised customer data, disrupted operations, and severely damaged trust. From data exposures through misconfigured cloud storage to sophisticated assaults by international threat groups, these incidents have not only impacted consumers but shaken confidence in the resilience of digital retail infrastructure.

High-profile breaches in 2025 have shown the many ways retailers are vulnerable. In one case, millions of customer records were exposed due to poor cloud security practices by a third-party vendor, underscoring how interconnected the risks have become. Another series of coordinated attacks caused widespread payment system failures and disrupted supply chains across thousands of stores, leading to hundreds of millions in financial losses. Even when attackers failed to fully penetrate systems, retailers were forced to take drastic precautionary measures, such as disabling internal networks or limiting access — a clear sign of the sector’s unpreparedness.

Adding to the pressure, data leaks through external service providers continue to pose a major risk. Sensitive personal information including names, emails, phone numbers are regularly accessed through these indirect channels, highlighting how a retailer’s weakest link often lies beyond its immediate control.

Why retail is under siege

Retailers have become prime targets for cybercriminals, and the reasons are clear. The sheer volume of sensitive data they manage, combined with the constant transactional flow of online purchases, creates a rich target environment. Globally, over one-third of the population shops online — a trend that has accelerated rapidly and shows no sign of slowing down.

The challenge lies in the high-stakes nature of retail operations: even brief disruptions can result in massive revenue losses and customer dissatisfaction. In markets where regulatory frameworks like GDPR are in force, breaches carry not only reputational damage but also significant legal and financial consequences. These factors make retailers attractive targets for extortion and ransomware, as attackers know their victims have both the means and the incentive to pay.

Moreover, current economic and geopolitical instability has only increased the frequency and sophistication of cyberattacks. Security teams are often overstretched, working with outdated systems or relying heavily on third-party infrastructure. In such an environment, opportunistic actors exploit every possible weakness, particularly those introduced through the supply chain.

A new mindset for resilience

What unites recent retail breaches is not just the damage caused, but the underlying patterns: poor cloud governance, unvetted vendor access, and reactive security measures. To reverse this trend, retailers must move beyond perimeter defences and adopt a proactive, data-first approach to cybersecurity.

This means building systems that assume no one — inside or outside the organisation — can be trusted by default. A zero-trust architecture, paired with continuous real-time monitoring and rapid incident response, is essential to reduce the window of opportunity for attackers. Data protection must be embedded at every point of the customer journey, from checkout systems to cloud storage.

Equally important is robust vendor and partner management. As long as sensitive data passes through third-party hands, cybersecurity cannot be treated as an internal issue alone. Every supplier must meet stringent security standards, and retailers must have visibility into how and where data is stored.

The solution is not purely technical. Retailers remain behind the curve not just in security infrastructure, but in executive accountability. Cybersecurity must be elevated from a siloed IT concern to a board-level issue, with leadership taking active ownership of risk management. This means aligning budgets with threat levels, integrating cyber criteria into supplier decisions, and ensuring recovery strategies are in place well before a breach occurs. The retail sector stands at a critical crossroads.

With digital transformation now the norm, cybersecurity must evolve from a reactive obligation into a strategic pillar. As the recent wave of attacks shows, the question is no longer if a breach will occur, but when. Only those who act decisively today will remain secure and competitive tomorrow.