Another season of swiping and spending is over and retailers across the UK are relishing boosted sales without fretting over the integrity of their internal systems.
Unfortunately, there’s no such thing as carefree consumerism anymore and retailers are increasingly considering modernising their security posture to keep up with sophisticated and large-scale attacks.
In the wake of another frivolous festive season, we looked back at some of the most serious (and recent) security breaches experienced by Retailers.
Target
In December 2013, Target reported one of the biggest security breaches ever in Retail. The information on at least 70 million shoppers, amounting to 11 gigabytes of data was accessed by cyber attackers.
It started after a phishing email duped an employee of Target third-party vendor Fazio Mechanical, allowing Citadel, a password-stealing bot variant, to be installed on Fazio computers. The attackers then breached Target’s Ariba vendor portal, gained entry into the retailer’s internal network and took control of Target servers.
From there, attackers infiltrated Target’s point-of-sale (POS) systems and spent more than two weeks scraping and dumping credit card data to sell on the black market.
Target did largely recover from the breach in terms of financial impact, and while it’s true many consumers will have continued to shop with the retailer, Target will be forever associated with the data breach and its lasting repercussions on brand image and customer trust. Not to mention the CIO getting sacked.
Home Depot
In September 2014, Home Depot, the world’s largest home-improvement retailer, with 1,977 stores in the United States and 180 in Canada, confirmed that it had joined the growing ranks of American companies targeted by a cyber-attack – compromising approximately 56 million users data.
Using custom-built malware to avoid detection, cyber-criminals were able to lift the names, credit card numbers, expiration dates, cardholder verification values and service codes for customers who made purchases in Home Depot stores between April and September of 2014. The malware was eventually removed ten days later and it appeared to be unlike any other used in previous attacks.
The incident had many repercussions for the brand including the CEO publicly apologising to customers and providing credit monitoring for a year for affected customers. It is reported the attack cost Home Depot $179 million. Yikes.
Forever 21
In 2017, fashion retailer Forever 21 confirmed there had been unauthorized access to data from payment cards used at some of its 815 stores, spanning 57 countries.
It was reported there were concerns the retailer was not fully PCI compliant and did not receive an encryption upgrade to their point of sale devices, giving hackers the opening they needed to access payment card information.
Just another example that shows retailers are prime targets for cyberattacks and should make sure they practice safe cyber hygiene like encrypting data, regular penetration testing and monitoring of systems and employee training on proper privacy and security protocols.
How to avoid the same breaches
Security isn’t a pain-in-the-neck compliance issue anymore, cyber criminals are advancing their attack strategies at a rapid pace and turning to even more complex encryption to outsmart even the most sophisticated anti-malware.
These attacks served prove that all information that is stored on a server can be subject to an attack, and that all digital assets, including credit card processing devices, are at risk of an attack. It’s up to Retailers to adopt the strongest safeguards possible to prevent attacks as disastrous as the Target breach.
We want to help you overcome the complexities of modernising your security operations. We’ll help you design and build a modern security strategy fit to protect your business, data, users and customers.
We’ll provide a view of how you are securing your organisation today, how you want to drive security for tomorrow and how to bridge the gap to enable you to achieve that goal.
