THE RETAIL INDUSTRY is seeing an increase in cyber incidents as the sector becomes more digitalized, with these threats mostly targeting consumers’ personal data, according to a study by cybersecurity company Kaspersky.
A study by Kaspersky’s Internal Research Center that surveyed IT security specialists in the retail sector across 18 countries showed that 87% of global retailers, including those in the Asia-Pacific (APAC) region, faced cyber incidents over the past 12 months.
It said phishing was the prevalent threat, reported by 21% of retailers, while other social engineering-related attacks featured deepfakes (13%), invoice or payment fraud (13%), business e-mail compromise (9%), and vishing or voice phishing (8%).
The top three most frequently experienced incidents in retail organizations also included cyber espionage (19%) and web application exploits (18%).
According to the study, attackers’ main goals were to steal the personal data of clients (34%) and employees (28%).
In APAC, the most common actual results of recent attacks on retailers were employees’ personal data theft (44%), clients’ personal data theft (39%), the theft of sensitive data such as financial credentials and legal documents (33%), and irrecoverable data loss (33%).
“The global retail sector, encompassing e-commerce, loyalty programs, and personalized offerings, spans the entire transaction process from initial browsing to final payment, thereby accumulating massive volumes of personal data. With only 13% of the sector escaping cyber incidents over the past year, it is clear that this environment is highly vulnerable to cyberthreats and appealing for cybercriminals,” Kaspersky said.
“Taken together, this diversity of threats shows that retailers are exposed not only to manipulation of employees and partners, but also to technically complex attacks against their online infrastructure.”
The study also showed that human actions and the lack of security awareness were among the top internal risk factors that increase the likelihood of cyberattacks on retailers.
“According to the poll across the APAC region, human actions tend to be the primary concern, with a lack of IT security awareness (46%) topping the list. It is followed by insufficient expertise among IT security staff (31%) or outdated software or hardware (31%). Technical shortcomings also had a strong impact: the lack of necessary security solutions was recorded by one in every four organizations (27%),” Kaspersky said.
Asked about the most typical digital misbehavior of their colleagues, 50% of respondents in the APAC region pointed to sharing sensitive corporate credentials with colleagues or third parties. Some 46% also cited the act of downloading and installing software tools without IT security approval, while 38% mentioned the use of personal devices for work-related activities and the storage of corporate data.
“Employees were found to still practice irresponsible password habits, including weak or reused passwords (38%) and also connect corporate devices to public Wi-Fi networks without using a secure connection (38%),” it added.
Kaspersky said cyberthreats targeting retailers may become more advanced as the sector’s artificial intelligence (AI) adoption increases, adding that many companies in APAC said they are already implementing AI tools in their infrastructure.
“Retail has traditionally been one of the most receptive to new digital technologies industries. Intense competition, pressure on margins, and constantly changing consumer behavior give retailers a direct economic incentive to adopt technologies that can improve business efficiency faster than their competitors,” said Elizaveta Komarova, solution architect, Finance & Retail at Kaspersky. “However, businesses should constantly balance potential returns against the level of risk they are willing to accept in pursuit of those returns… Since a serious incident can cause data breaches, operational disruption, and severe financial losses, cybersecurity must evolve at the exact same pace as the business.”
“Our APAC findings highlight an important gap in retail cybersecurity in the region. As retailers here adopt more connected and AI-driven technologies, it is becoming clear that some of their vulnerabilities stem from how technology and data are used and protected across the organization. That is a good indication that cybersecurity needs to extend beyond the IT team and become part of how retailers operate, employees work, and new technologies are introduced into the business,” said Adrian Hia, managing director for APAC at Kaspersky.
With this, 77% of retailers in the APAC region said they increased their IT security budget this year, with most of them turning to third-party security providers.
“Retail is a highly dynamic industry: business priorities, workloads, infrastructure requirements, and economic conditions change rapidly. To ensure that cybersecurity keeps pace with these changes, retailers choose to turn to external security service providers, gaining access to the required expertise and technologies without having to continuously expand their in-house teams,” Ms. Komarova said. “By outsourcing part of their cybersecurity functions, retailers effectively entrust an external partner with the resilience of their business processes and the financial risks associated with security incidents.”
Kaspersky said retail companies must elevate their overall cyber culture to improve cybersecurity awareness and reduce risky workplace behaviors that can put both employee and customer data at risk, and also deploy endpoint protection solutions on workstations, laptops, and mobile devices to detect and prevent cyber incidents.
Organizations must also identify and protect their most valuable assets and essential business processes, such as customer data, intellectual property, core applications, and supply-chain workflows, and monitor the current state of cybersecurity in the industry by regularly assessing potential threats and vulnerabilities. — Bettina V. Roc