Retail Leads the Way in Data Breaches — Here's How to Protect Your Customers

These attacks aren't random, and there are plenty of reasons that hackers go after retailers. Even the strongest retail players are at risk: with massive amounts of customer information being stored across multiple channels, combined with limited IT resources (and sometimes a hodgepodge of new and old systems and hardware — or just fully antiquated systems altogether), the task of successfully defending their networks from vulnerabilities is daunting to say the least. Other reasons that retailers are at risk include:

• Retailers are continuously processing large volumes of payment data, which translates to easy payouts for hackers if they can get into the system. Payment data is most commonly stolen through point-of-sale (POS) breaches, which make up 64% of all incidents, and a magnetic stripe data attack was the second highest at 33%. Because hackers have found ways to access the card data before it gets encrypted into the POS system's memory, retailers that use POS machines need to provide end-to-end encryption for all credit card transactions in order to protect customer data.
• The technology that makes “tap to pay” or “mobile wallets” possible (called Near Field Communication) is a huge convenience for customers, but also poses its own security risks, as businesses aren't able to control who is accessing their system. For example, if a customer's phone is hacked, and they use Apple Pay, or any other mobile wallet, a virus could be introduced into the retailer's network. As more and more people begin to utilize mobile payment, we will likely see this technique used more often by hackers.
• In this day and age, retailers must utilize a multi-channel strategy to remain competitive. The downside to this is that it makes data security a bit more challenging in that customer information is spread out across multiple channels.
• The retail industry is known for having high turnover rates, and perhaps because of this, there's often a lack of internal security education. Particularly during busy seasons (e., holidays), many stores rely on hiring temporary employees who may not go through as stringent of background checks. This means that some of these workers may be more likely to have a criminal background, which could put the business at a greater risk.
• Hackers are also very well aware of when retailers' peak business periods will be, so it's easy to use blackmail as a threat during these times. Additionally, because companies worry about their systems breaking during peak traffic, they avoid changing the code for their websites and mobile apps. This leaves stores' systems — and all the data they hold — particularly vulnerable.
• Generally, we often don't see cybersecurity as a central focus among retailers. The spotlight is often on revenues, with data security sometimes seen as an afterthought. And hackers know this.

Cybersecurity Professionals in the Retail Industry Need to Do More

The increasing normalcy of data breaches in the retail industry has highlighted the fact that retailers need to be doing more — particularly in terms of protecting customer data. This must start from the inside out. Data security and compliance must crosscut the entire organization. Leaving this significant task just to IT or another dedicated department fails to address the larger issue: all staff are stakeholders in a company's data protection, and therefore must be trained on security best practices and requirements on an ongoing basis.

Indeed, the most common (and easiest) way for hackers to access and steal sensitive information is through spear phishing: a form of phishing in which a hacker attempts to target one or more individuals using finely-tuned, personalized tactics to trick users into breaking security procedures. As one of the most successful forms of phishing on the Internet today, over 90% of all cyberattacks are successfully executed with information stolen from employees who unwittingly give away their system ID and access credentials to hackers. For the most part, this is behavior that can be rectified with more training and vigilance, which is why education of all employees is so important.