INDUSTRY FACT FILE · RETAIL & E-COMMERCE

Threat Landscape: Top Cyber Threats Facing Retail and E-commerce

The 18 most relevant cyber threats, attacks and industry challenges for retail chains, marketplaces, D2C brands, quick-commerce platforms and loyalty programmes, and the impact each one has on revenue, customers and partners.

Retailers attract three kinds of attacker. Fraudsters want what converts to money fastest: cards at the checkout, loyalty points, gift cards, refunds and accounts with saved payment methods. Data brokers want customer databases—names, phones, addresses and order histories—that fuel phishing and resale. Ransomware groups want leverage, and nothing creates leverage like a retailer whose stores, warehouses and apps stop in the festive season. The attack surface is unusually public: storefronts and APIs are open to anyone, third-party scripts run inside the checkout, and partners from couriers to franchisees hold access.

Landmark incidents show the pattern. Target (2013) lost about 40 million card records through an HVAC vendor's credentials and paid an US$18.5 million multistate settlement; British Airways (2018) was fined £20 million after Magecart skimming code harvested more than 400,000 customers' details; Marks & Spencer (2025) estimated a £300 million profit impact after ransomware entered through a contractor. In India, BigBasket (2020), Juspay (2020), Domino's India (2021) and boAt (2024) each saw millions of customer records offered online; Verizon's 2025 DBIR found third-party involvement in 30% of breaches and ransomware in 44%, and Imperva measured bad bots at 59% of retail traffic.

The list below is a practical assessment framework, not a statistical ranking. Priority varies by business model, technology exposure and existing controls.

The matrix is a qualitative guide for prioritising the first round of security reviews.

Figure 5: Qualitative threat relevance by retail segment (Codec Networks assessment).

4.1 Payment page skimming and the third-party script problem

Magecart-style attacks do not break the gateway; they compromise a script already trusted by the checkout—an analytics tag, a chat widget, a plugin—and copy card details before tokenisation happens. British Airways' 2018 breach ran for just over two weeks and cost a £20 million fine; PCI DSS v4.0.1 now expects an inventory of payment page scripts and tamper detection.

• Questions to test: Which scripts load on our payment page and who can change them? Are card fields isolated in hosted or tokenised components? Would we detect a modified script? Does each script vendor meet our security requirements?
• Relevant services: payment page script review, tamper detection design, payment integration testing, third-party script risk assessment.

4.2 Account takeover, bots and the festive peak

Leaked passwords and automated tools make account takeover industrial. Bots that hoard stock, test stolen cards and scrape prices are 59% of retail traffic, and DDoS-for-hire attacks are timed for sale days when every minute of checkout downtime is lost revenue.

• Questions to test: Do login and OTP flows resist credential stuffing? Are cart and checkout APIs rate-limited and bot-managed? Have we load- and DDoS-tested at peak volumes? Who is in the war room on sale day?
• Relevant services: ATO and credential-stuffing testing, bot management design, load and DDoS resilience testing, festive-season SOC watch and drills.

4.3 Customer data and the DPDP clock

Retailers hold more personal data than most banks—every address, phone number and purchase. The BigBasket, Domino's India and boAt leaks show how quickly that data reaches forums and feeds phishing. From May 2027 the DPDP Rules add consent, retention and breach-intimation duties on top of CERT-In's six-hour reporting.

• Questions to test: Where does customer data live—CRM, CDP, cloud exports, agencies? Who can reach it? Is it minimised and encrypted? Could we detect and report a leak in six hours and intimate affected customers?
• Relevant services: data mapping, cloud posture and secrets review, DPDP programme, DLP and monitoring, breach workflow.

4.4 Ransomware and partner access across stores and dark stores

Retail estates are distributed: hundreds of stores, dark stores and franchisees connected to central OMS, WMS and POS back-ends. Target's HVAC vendor and Marks & Spencer's contractor show that a partner's credentials are the easiest way in, and a ransomware event at the centre stops every site at once.

• Questions to test: Which partners, franchisees and vendors can reach our core systems? Is access brokered with MFA and least privilege? Are WMS, OMS and POS back-ends segmented? Are backups immutable and restores tested?
• Relevant services: zero-trust partner access design, segmentation review, backup and restore testing, third-party risk programme, EDR and SOC.

4.5 Loyalty, refunds and stored value

Points, gift cards, wallets and refund workflows are cash equivalents sitting behind consumer-grade authentication. Attackers take over accounts, redeem points to gift cards and resell them within hours; organised refund fraud exploits generous return policies and support processes.

• Questions to test: Can points and gift cards be redeemed without step-up authentication? Are redemption and refund velocities monitored? Are support agents able to override controls? Do fraud and security teams share signals?
• Relevant services: business-logic testing of loyalty and refund flows, redemption controls, fraud signal integration into SOC, insider and agent access review.

• CERT-In: incidents reported within six hours of noticing them; logs available for investigation.
• RBI and payment partners: card data incidents trigger aggregator, acquirer and card-network processes, forensic investigation and potential penalties.
• PCI DSS: a breach involving cardholder data leads to a PCI forensic investigation and re-validation.
• Consumer protection: complaints about fraud, failed refunds or deceptive interfaces reach grievance officers and the CCPA.
• SEBI LODR: listed retailers disclose cyber incidents and data loss in the quarterly corporate governance report.
• DPDP: incidents involving customer personal data trigger breach intimation to the Data Protection Board and affected individuals once provisions commence in May 2027.

• Which scripts run on our payment page, and who approved them?
• Would our checkout survive sale day under a bot and DDoS attack?
• If leaked passwords were replayed against our app tonight, how many accounts would fall?
• Where is every copy of our customer database, and who can reach it?
• Which partner or franchisee could bring ransomware into our core systems?
• Could we detect, contain and report an incident within six hours while keeping stores and deliveries running?

Note: Threat descriptions and relevance ratings are general guidance, not findings about any specific organisation. Public incident references are summarised from widely reported events and company disclosures.