By Tonia Dudley
The advent of the modern-day shopping mall was in the mid-1950’s and it continued to rise in popularity as the go-to place for shopping in the decades thereafter. Watching the hit series Stranger Things is a great reminder of the mall experience, but how times have changed with the introduction and boom of the internet. Retailers shifted their approach to stay relevant in the online era by standing up websites to accompany their brick & mortar locations.Today we see retail outlets that exist solely in the web sphere – without any type of building. They are prime targets not only for consumer fraud but also cyber-attacks on retail data and reputations. The online marketplace excels in delivering goods quickly to the “I need to have it now” buyer. Threat actors excel too. They are masters at leveraging this urgency, as well as today’s delivery methods, to lure shoppers into scams.
And consumers aren’t the only targets. Attackers go after employees at retail organizations with phishing emails designed to steal customer data and create a PR nightmare. When this happens, consumers naturally think twice about buying again.
83% of consumers are concerned about purchasing from a company that was previously breached.
60% of POS compromises started with a phishing attack.
Source: 2019 Generali Global Assistance Cyber & Digital Protection Survey
What does this all mean when it comes to the phishing threat landscape? Consumers generally require a username and password to place an order on most websites. Based on threat intelligence from our research teams here at Cofense™, we know that threat actors primarily craft emails designed to steal credentials, both from consumers to gain access to online accounts and from retail employees to gain a foothold in an organization and compromise further. This is why it is critical for retail organizations to ensure their support staff have been trained to identify and report phishing attempts to gain access to their credentials.
29% of all breaches involve stolen credentials.
Source: 2019 Verizon Data Breach Investigations Report
Cofense partnered with the Retail ISAC this past summer to conduct a benchmark study. Participants ranged from small to large organizations. It is clear that organizations with an easy reporting method – a button within the mail client – are more resilient to defending against a phishing threat.
Figure 1: Susceptibility and resiliency rates for manual reporting vs. email button-based reporting, average
Retail organizations are no different than other industries – to effectively defend against phishing attacks, they need visibility of attacks that have bypassed existing controls. It takes more than a Secure Email Gateway and phishing Computer Based Training to enable Security Teams to respond quickly and reduce the risk of compromise or data breach. Cofense is uniquely positioned to help retail organizations unite to fight phishing through our comprehensive phishing defense portfolio.
To learn more about retail phishing attacks and how Cofense can help, view our new infographic.
All third-party trademarks referenced by Cofense whether in logo form, name form or product form, or otherwise, remain the property of their respective holders, and use of these trademarks in no way indicates any relationship between Cofense and the holders of the trademarks. Any observations contained in this blog regarding circumvention of end point protections are based on observations at a point in time based on a specific set of system configurations. Subsequent updates or different configurations may be effective at stopping these or similar threats.
