Retailers like to stand out — but not when it comes to the shadowy and expensive world of cybercrime.
Moody’s recently ranked 21 U.S. sectors on cyber risk in the age of AI, looking at each sector’s exposure to online threats and the strength of its defenses.
The Cyber Risk Heat Map showed that retailers not only have “large digital footprints” but “moderate defenses with some of the highest modeled losses.”
“Retail is one of five sectors with the highest overall cyber risk (media, telecom, education, retail, IT hardware) and one of five with the highest modeled losses as a share of gross profit (food and agriculture, manufacturing, energy, media, retail),” Moody’s said, pointing out that media is the only other sector in both groups.
The 24/7 advantages of being able to sell online come with some pretty big risks.
And cautionary tales come with some regularity.
Outside of retail, the giant cryptocurrency exchange Binance said Friday that hackers withdrew $6.3 billion, forcing the service to suspend withdrawals while security checks were completed. The company’s initial investigation suggested “the security incident may involve a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions.”
Closer to home and on a smaller scale, hackers threatened Asos recently — sending its app users an alert that called out the company’s data protection officer and claimed to have “fully compromised the Snowflake instance,” apparently referring to the cloud-based data storage company. Hackers accessed an Asos employee’s account by impersonating “a trusted contact to obtain login credentials,” the e-commerce company said.
Christopher Vos, director of cyber modeling at Moody’s, said retailers aren’t especially likely to be attacked by hackers, but “it’s pretty bad when it happens.”
Retailers collect a large amount of personal information and have complex supply chains with vendors often accessing their systems.
They’re also operating with what Vos described as a business model that is “quite sensitive to disruption.”
“If a bad guy can get in and drop a ransomware payload — for example, lock up a bunch of their machines — the retailer’s squirming a fair amount,” he said. “And as a result, they can demand quite a high ransom and get some payment out of that.”
While Vos said retailers are “reasonably well positioned” against phishing emails and so forth, “it only takes one person to click the link in order for someone to come through. The defenses of retailers as a whole aren’t amazing. It’s not like it’s like banks or something like that. They’re not super, super hard targets.”
Like grocery stores, fashion retailers also have perishable inventory that they have to move, making cyber disruptions particularly problematic.
Vos said there are plenty of steps retailers can take to reduce their cyber risk, from patching critical vulnerabilities to segmenting the company network so gaining access to one area doesn’t give hackers free run of the systems.
It’s also key to back up critical systems and keep the backups isolated from the rest of the network, he said.
“And then, crucially, actually doing fire drills, practicing using some of these sort of recovery mechanisms is really important,” he said. “It’s all very well having something on the shelf that looks great, but when the time comes, if you don’t know how to actually bring things back up online quickly and somewhat painlessly, then it doesn’t matter that much.”
#Retailers #Face #High #Cyber #Risks #Costly #Losses #Attacks