Human factor key as UK retailers face sharp rise in cyber attacks
A new report highlights a significant rise in cyber threats targeting the retail sector in the United Kingdom, with particular concern over IT and helpdesk support scams.
The study, conducted by KnowBe4, surveyed 250 IT security professionals across UK retailers and provides insight into the state of cyber defences and threat perceptions within the industry. According to the findings, nearly all respondents (99.6%) indicated that they had faced a marked increase in cyber attacks in recent months.
Helpdesk and IT support scams have emerged as the most prevalent threat, cited by 58% of those surveyed. These exploits are designed to deceive frontline staff into compromising sensitive systems and information, underlining the increasingly human-centric approach of cybercriminals. Further threats regularly encountered by retailers include phishing (47% of respondents), credential theft (54%) and supply chain attacks, with the latter affecting nearly half of the companies observed in the study.
Industry response
Retailers are reportedly responding to these threats with increased vigilance at the executive level and a renewed focus on human risk management. The research outlines that 72% of the surveyed organisations have seen greater engagement from leadership teams regarding cybersecurity issues. Additionally, 58% have increased their security budgets in anticipation or as a direct response to these evolving risks.
Investment is increasingly being channelled towards controls that target human risk, according to the study. Security awareness training was the most popular area for expenditure, with 74% of respondents making it a top priority. This reflects a growing recognition within the sector that employees are often the last line of defence against increasingly sophisticated cyber threats.
Supply chain vulnerabilities
The survey found that third-party suppliers represented the largest security gap for 46% of the retailers polled. The issue is highlighted by recent incidents, including a breach at a major retailer traced back to a compromised vendor. This pattern underscores the interconnectedness of modern retail operations and the potential for vulnerabilities outside of immediate organisational boundaries.
Planning and preparedness
The report also reveals that while organisations are putting tactical plans in place, there is sometimes a shortfall in follow-through. Ninety-one percent of respondents have conducted security audits, and 96% have documented incident response plans. However, only 65% have actively tested these plans, possibly leaving gaps in practical preparedness for real-world attacks.
Alongside investment in training and cultural change, the research shows that 71% of the surveyed retailers have earmarked dedicated reserves for possible ransom payments, reflecting a pragmatic response to the ongoing threat of ransomware.
Emphasising the human factor
"These threat vectors highlight the human dimension of modern retail cyber risk. Phishing, credential theft and helpdesk scams all exploit human decision-making. The report is a reminder that cybersecurity is not just a technical challenge and organisations need to embed human-centric defences throughout operations. While we are seeing progress here, ultimately it is not enough to just have a plan on paper. In addition to an investment in awareness training, behavioural change initiatives and creating strong and positive cultures that support secure decision-making, retailers need to ensure response plans and processes are well tested and communicated to employees. It is about changing behaviour and building cultures where secure choices are second nature," said Javvad Malik, Lead Cybersecurity Advocate at KnowBe4.
The KnowBe4 report concludes that while technical measures remain crucial, the changing landscape of cyber crime in the retail sector requires a sustained focus on culture and behaviour throughout organisations.
Phishing, fraud, supply chain exploitation and social engineering attacks have all intensified according to almost all respondents, making a holistic approach to security – one that encompasses human risk management as much as technical solutions – a high priority for UK retailers.