Global e-commerce enjoyed a record-breaking year for sales in 2020, with lockdowns encouraging customers to shop from the comfort and safety of their own homes. In the US alone, sales were up by more than 30 per cent year-on-year, and in the first six-months sales exceeded $2 billion for 130 days, compared to just two days the previous year.
In Australia, the boost to sales was even more significant, with an annual rise of 67.1% from March to October 2020, and one million new households shopping online each month.
While this sales boom undoubtedly creates new opportunities and stronger cashflow for retailers, with notable customer benefits, it also gives rise to a new breed of criminal. No longer are retailers worried about teenage shoplifting and petty theft. Of greater concern is large-scale cyber-crime, which has the ability to significantly disrupt online platforms, steal business and customer data, as well as jeopardise a brand’s future through reputational damage.
Imperva’s Cyber Threat Index shows cyberthreats for the global retail sector increased dramatically at the start of the global lockdown when online sales soared. The table below shows cyberattacks during COVID-19 outpaced the previous year’s busiest global shopping events, such as Black Friday sales, resulting in unprecedented risk to the industry. As we approach end-of-financial-year (EOFY) sales, it is important to understand the risks facing the retail sector and how businesses can protect themselves and their customers.
Four types of cyberthreats in retail
Like a good pair of jeans, cyberthreats are not one size fits all. As detailed below, there are several types of cyberthreats – in all shapes and forms – impacting retailers, with each having its own unique characteristics and risks to the industry.
- Bad bots abusing websites, mobile apps, and APIs
A majority of the attacks on the retail sector originate from automated bot activity. Competitors and cybercriminals can use “bad” bots to aggressively scrape pricing and inventory information, while other illegal bots can create denial of inventory problems for customers seeking popular or limited-edition items. Criminals also use these bots to commit fraud by stealing gift card balances, gaining access to user accounts, and committing credit card theft.
- API and web attacks
Cyber-attacks targeting websites and application programming interfaces (APIs) have reached record levels. Data leakage, where attackers steal weakly protected sensitive data (often financial) to conduct fraud or identity theft, accounted for 21 per cent of web attacks, while hackers attacking vulnerable web applications with malware was equally prevalent. Cross-site scripting, where hackers target users of the website with malware and trojan horses to steal private information, accounted for more than 16 per cent of attacks. The volume of attacks on retailers’ APIs also exceeded industry averages during the peak shopping seasons.
3. DDoS attacks
The goal of denial of service (DDoS) attacks is to bring down an online retailer platform by exhausting its processing resources with a high number of requests. This style of attack peaked significantly in April 2020 as lockdown measures led to an increase in demand for online shopping.
- Account takeover (ATO) and client-side attacks
ATO is an attempt by cybercriminals to take over users’ accounts for malicious purposes. Online retailers experienced more than twice as many ATO attempts than any other industry. A client-side attack results from cybercriminals targeting online baskets to steal customers’ payment details and is a significant vulnerability for online retailers.
Detecting the invisible
To protect your customers and business it is integral to protect all paths to data – not just the front door. Cybersecurity needs to extend beyond websites and encompass all digital paths. Understanding where critical data exists, how it is accessed, and the types of data stored is critical. Retailers need to be able to evaluate, monitor and detect threats to data in real-time and seamlessly take action with minimal requirement for manual intervention.
The overarching goal of cybersecurity is to mitigate online attacks closest to the source and furthest away from your network and infrastructure. Beyond breaches of privacy, at a minimum, cyberattacks can significantly impact your website’s performance, causing significant slowdowns or shutdowns. The closer we mitigate attacks to the source, the less likely it is to impact on customer experience and satisfaction.
While the opportunity has never been greater in e-commerce, business risk has grown significantly with a competitive, crowded market and unprecedented cybersecurity threats. A cyberattack can not only disable a retailer’s online platform but tarnish its reputation with customers and prospects. A trusted, leading cybersecurity provider will take you through simple steps to protect your business throughout its digital journey. Ensuring holistic cybersecurity protection spanning the edge, apps and datastores will not only ensure you are doing the right thing by your customers but also gives you competitive advantage, steering strong sales growth and a favourable customer experience across all channels.
Reinhart Hansen is director of technology for Imperva CTO Office.