Threat Landscape
Retail cybersecurity is the cybersecurity of every consumer's daily relationship with the economy. A breach is felt at every cash register and every browser checkout simultaneously.
The retail and e-commerce threat landscape is defined by visibility. Unlike most industries where a breach affects internal operations or specific business-customer relationships, a retail breach is felt by ordinary consumers at the cash register, at the contactless terminal, and at the e-commerce checkout — often within hours. The 2025 Marks & Spencer attack is the canonical recent illustration of public-facing consequence at strategic scale: customers across the UK could not complete contactless payments, could not collect Click & Collect orders, could not buy online for 46 days, and watched grocery-shelves remain empty as the company reverted to pen-and-paper for fresh-food and clothing supply tracking.
The April 2025 M&S attack was attributed to Scattered Spider (the same threat collective behind MGM and Caesars 2023) deploying DragonForce ransomware. Initial access was reportedly achieved through social engineering of the Tata Consultancy Services (TCS) helpdesk that runs M&S's IT support — attackers posed as one of the 50,000 people associated with the company and successfully manipulated the helpdesk into resetting an internal user's password. Within days, attackers had stolen the Windows domain's NTDS.dit file, cracked the password hashes, gained unauthorised access to M&S's network, and deployed DragonForce ransomware to encrypt virtual machines. The financial impact: GBP 300 million estimated profit impact, GBP 700+ million market-value loss, GBP 40 million per week revenue impact during the disruption per Reuters. [01]
In April–May 2025, three of the UK's most recognisable retail brands were targeted in the same campaign window — M&S, Co-op, Harrods. The Co-op confirmed customer-data exfiltration including names, dates of birth, addresses, email addresses, and phone numbers. Harrods declined to disclose financial impact. The threat-actor portfolio that hit Las Vegas casinos in 2023 is now hitting UK high street retailers in 2025.
The 2024 Snowflake-platform ShinyHunters / UNC5537 campaign exposed Ticketmaster (560 million customer records), AT&T (109 million call/text records), and other Live Nation properties through credential-based attacks against under-protected SaaS data warehouses. The 2024 Roku breach exposed hundreds of thousands of user accounts. The 2013 Target breach (40 million payment cards) and the 2014 Home Depot breach (56 million payment cards) established the template that contemporary attacks have refined: retail breaches scale automatically with retail customer-base size. [02]
NCC Group identified consumer cyclicals (non-essential retail) and consumer non-cyclicals (essential retail) as the second and fifth most-targeted ransomware verticals in H1 2024 respectively. The retailer attack pattern combines high public visibility (which cybercriminal groups exploit for negotiating leverage and reputation), seasonal pressure points (which create ransom-payment urgency at peak revenue periods), and substantial customer-data corpora (which create exfiltration opportunity at massive scale).