In the wake of recent attacks on ASOS, Hobbs and Intermarché, Tom Exelby, head of cyber security at Red Helix, explains how suppliers can be exploited by cyber-criminals targeting retailers.

Recent cyber incidents affecting ASOS and the owner of Hobbs, Phase Eight and Whistles, alongside attacks on supermarket refrigeration systems in France, show how widely retail’s exposure now extends, from customer information to the equipment that keeps stock fit for sale. Years spent connecting systems and outsourcing specialist services have brought considerable efficiencies, but they have also created dependencies that conventional supplier checks may fail to capture.

This helps explain why retail is such an attractive target for cyber criminals. Retailers hold substantial volumes of customer information, including contact details, purchasing histories and loyalty data, while their ability to trade depends on interconnected systems operating reliably. Disruption can affect online orders, store payments, replenishment and deliveries simultaneously, creating immediate commercial pressure. Customers have alternatives, perishable stock has a shelf life, and a missed trading opportunity cannot necessarily be recovered when systems return.

Throughout 2025, one of the most active criminal groups concentrated on UK and US retailers, targeting help desks, identity systems and backup infrastructure. Attackers are also increasingly abusing trusted relationships, including suppliers and software supply chains. Meanwhile, 69% of ransomware attacks in 2025 executed outside business hours, and legitimate remote management tools were abused in 78% of incidents.

Recent attacks show the scale of disruption and damage attacks can have, M&S suspended online and app orders for weeks, and Co-op reported an estimated £206 million in lost sales from its attack.

Source link