Despite retailers facing a number of obstacles, from low inventory to staff shortages, the National Retail Federation expects the rise in holiday sales during November and December to break records, between 8.5% and 10.5%, for a total of between $843.4 billion and $859 billion of sales.
With so much at stake, it is not surprising that the retail industry continues to be a top target for financially motivated criminals looking to cash in on the combination of Payment cards and Personal information, according to the Verizon DBIR 2021. In fact, earlier this month electronics retail giant MediaMarkt suffered a Hive ransomware attack. MediaMarkt is Europe's largest consumer electronics retailer, with over 1,000 stores in 13 countries.
To reduce the risk -- and costly damage -- that these attacks can wreak, retailers should:
Prepare for Supply Chain Disruption: Recently, Diamond Comic Distributors, a key distributor for comic books to comic shops, bookstores, and online booksellers like Amazon, disclosed that it had fallen victim to a ransomware attack. A week later, the company was still dealing with the attack’s aftermath, having to create a new temporary website, replace its compromised email system with a third-party email setup and managing delayed shipments. To ensure business continuity in event of an attack, retailers should develop a detailed response plan and have in place redundant IT systems, processes, and procedures.
Create a Crisis Communications Plan: When an attack occurs, retailers need multiple ways to communicate their latest business updates to their customers, partners, and suppliers. Don’t wait until a crisis hits – develop a crisis communications plan now and be sure to practice it several times a year with your retail staff and update as needed.
Meet PCI Compliance: Non-compliance with PCI Data Security Standards such as “Develop and maintain secure systems and applications” can result in hefty fines. According to the PCI Security Standards Council, “Compliance with the PCI Data Security Standard and other applicable PCI Standards may be necessary for entities that store, process or transmit cardholder data. PCI Standards are for entities accepting or processing payment transactions, and for software developers and manufacturers of applications and devices used in those transactions.”
Know Your Network: Regularly audit your network and applications to identify and protect the attackable surfaces of your organization.
Protect Applications at Runtime: Software vulnerabilities remain a primary entry point for ransomware attackers. Protect your applications, both legacy and modern, to block both known and unknown threats. By fully understanding your software and mapping everything it is supposed to do – and stopping what it is not supposed to do – the Virsec Security Platform can fully protect against ransomware attacks.
The holidays present a lucrative opportunity for today’s attackers. Yet retailers will remain an ongoing ransomware target beyond December. We invite you to take steps today to reduce your attack surface, meet compliance standards and prepare for unexpected disruption. Want to learn more about how Virsec can help your organization? Contact us to see a demo and learn more.
