News about companies being hacked is becoming a near-weekly occurrence – from ASOS and H&M to the owner of Phase Eight, Hobbs and Whistles.
European supermarkets have also made headlines in recent weeks as hackers interfered with the temperature of fridges in a likely coordinated attack.
While the nature and scale of these cases varied, they share some characteristics: high financial cost, widespread media coverage and the potential to undermine consumer confidence, often with immediate and visible consequences.
The UK Government’s latest Cyber Security Breaches Survey found that more than four in ten businesses (43%) reported a cyber security breach or attack in the preceding 12 months.
But that same research revealed that only 31% of retail and wholesale businesses identified a breach or attack, compared with 49% in utilities, 45% in construction and 44% in finance and insurance.
So, why do we hear so much about retailers?
The most obvious answer is that the general public is most interested in the companies with which they interact on a regular basis. For this reason, retailers tend to be the businesses the media write about most frequently.
This has the potential to become a vicious cycle. The more immediate and visible the attack, the more successful in the eyes of the hackers – either because it is more likely a ransom is paid or that the sense of vulnerability and disruption is heightened.
It’s therefore essential that retailers – which hold large amounts of customer data and direct to consumer relationships – are prepared to respond effectively to what may well be an escalating trend.
But having a crisis plan on paper somewhere is not the same as being genuinely prepared for an actual attack. Businesses must be able to not only identify, assess and prioritise potential threats and vulnerabilities, but also test whether their response stands up to scrutiny.
This means regularly putting the relevant teams through their paces. Who makes the difficult decisions when systems go down? How do you communicate with customers and colleagues? And what do you say to investors and media when the situation is still unfolding?
These are questions you do not want to be asking for the first time in the middle of an attack.
In short, a crisis plan cannot be a tick-box exercise. And the question all leaders must ask is not simply if their business could be targeted next, but whether they are prepared for the consequences when it is.
The old maxim “retail is detail” has never been truer – it just now applies to cyber-defence preparedness as much as sales and logistics.
Read more from Headland: Insights & News