The dust might have settled on the Black Friday weekend, but the hard work has just begun for retailers across the globe. Some make more than a third of their annual revenue in the busy shopping period that roughly begins during Thanksgiving and ends in the early January sales. And as inflation continues to depress consumer demand, most will be wanting to squeeze as many sales as possible from shoppers.
But where there’s money and consumers, there’s also data and digital thieves. That’s why organizations can’t afford to take their eye off the ball this Christmas. A cyber-secure business is one built on strong data protection.
US consumers alone spent over $9bn on Black Friday weekend in 2022 and this year could be even more successful. The National Retail Federation estimates that total retail sales could top $960bn for November and December 2023. In the UK, the surge in sales may be slightly more muted at 3.4%, but as Europe’s largest e-commerce market they will still top £109bn (£137bn).
But the busy shopping season is also a magnet for threat actors. They bombard shoppers with phishing emails and texts, and scam websites. They use stolen data in an attempt to defraud retailers. And they may also look to take advantage of distracted IT teams to target back-end data stores. That’s because, at the busiest time of the year, the primary goal for most retailers is understandably to make as much revenue as possible. That means the focus is often more on website/app availability rather than security. It’s why many retailers reduce fraud checks to wave through more orders. Tech experts may also be pulled from traditional roles to support this push.
That may be a false economy if it leads to a serious data breach. An incident could lead to:
As more retailers invest in digital infrastructure to drive online sales, they mustn’t forget the other side of the coin: cybersecurity. A recent study found that a quarter (28%) of e-commerce web apps lack a web application firewall (WAF), including 24% of apps that collect personally identifiable information (PII). Half are riddled with vulnerabilities, while 2% of these apps still lack HTTPS.
That could provide a readymade pathway for threat actors to reach valuable customer data. Yet no matter how well retailers guard their web app and network perimeter infrastructure, a determined attacker will always find a way through. That’s why the focus for security strategy should be the data itself.
comforte’s Data Security Platform delivers:
Protecting sensitive customer PII and card data at source means that, even if threat actors manage to breach enterprise cyber-defenses, that data will be effectively useless to them. With comforte, retailers have the peace-of-mind not only that their data is secure, but that they can achieve compliance with GDPR and PCI DSS.