The cyber risks facing UK retailers – lessons from the US

Technology has changed the way we shop, but it also means retailers face serious cyber security issues
Tesco store in Carlisle
Thousands of customer accounts were suspended after a hacker attack in February 2014. Photograph: Alamy

Rarely has security vulnerability gained worldwide notoriety as quickly as that achieved by Heartbleed, a programming flaw in a critical part of the technology used to encrypt communication between secure servers on the internet. More than anything it has reinforced the importance of security awareness and the speed of response to such incidents.

Behind the omnipresent warnings over Heartbleed are the ongoing risks facing Britain's retailers. Experts are now raising concerns over the growing risk of cyber criminals gaining access to sensitive information held by such businesses. The sector is a prime target as incidents elsewhere have clearly shown, with research by US insurer Willis Group (pdf) suggesting that retailers are more likely to rate cyber incidents as having "significant, serious, material or critical" impact on their business, compared to other sectors.

Moves to improve cyber security at retailers in the US are likely to increase pressure on UK retailers. While their US counterparts have been in the crosshairs of hackers for some time, British merchants are not immune and it would be naive to believe that cyber-crime is a particular US phenomenon. Such risks are very much present here in the UK. Data breaches have already happened to UK retailers, both as a result of data theft from within a retailer's own organisation and hacking by criminal gangs.

The seriousness of the issue is further underscored by the British Retail Consortium's Retail Crime Survey (pdf), which found that the majority of retailers see cyber attacks as a critical threat to their business, with nearly two thirds targeted by hackers in the last 12 months.

Technology has a key role to play in today's retail environment and there are countless examples of innovation, for example in the development of sophisticated inventory loss systems. However, retailers are also data companies – in some cases more valuable than the merchandise – and there is a growing and significant black market for solid information.

So what can retailers do? For starters, they must pay greater attention to the security of the data they hold about their customers that can be used by criminals to make money. Retailers are custodians of large volumes of credit card and account information and should conduct regular reviews of both their security policies and the storage and maintenance of data. This must focus on establishing who has and should have access to such sensitive information, whether data is encrypted and what stage the encryption takes place.

The data "lifecycle" should also be looked at, so there's a clear understanding of what happens to all information, from the moment somebody swipes their card right up until the retailer no longer has the data. Similarly, companies must review other types of sensitive information – such as employment, staff and supplier records – the loss of which can be costly and embarrassing.

Most importantly, each potential incident requires a thorough investigation, and not just a superficial check to close down a known vulnerability. Many retailers and others have found that incidents that at first seemed minor were in fact incidents of a much more significant infiltration.

Without a clear commitment to addressing such emerging risks, which must go hand-in-hand with a focus on developing a broader strategy to improve cyber resilience, all businesses will be exposed to significant risks. Moves by the European Union could also add to such pressures, with the proposed General Data Protection Regulation proposing substantial fines in the event of a data breach, capped at 5% of global turnover or €100m.

However, the impact of a cyber security incident goes beyond the harsh financial realities. In today's world, as many victims have found to their cost, the reputational and organisational harm could also be significant. Cyber resilience is a matter of organisational management, not just an IT issue.

Significant cyber incidents like Heartbleed will continue to happen. Criminals are looking for the weakest link, within a retailer's own organisation or elsewhere in the supply chain. Advances in online technology has allowed the sector to get closer to customers and suppliers and such advancements have created new platforms for growth, but they have also created new risks.

Seth Berman is executive MD and UK head of Stroz Friedberg

To get weekly news analysis, job alerts and event notifications direct to your inbox, sign up free for Media Network membership.

All Guardian Media Network content is editorially independent except for pieces labelled 'Advertisement feature'. Find out more here.