Sectors · Retail

Trading through peakis the whole point.

Store estates, e-commerce platforms, hospitality and leisure. After the 2025 attacks on UK retail, boards understand the risk; we turn that into monitoring, testing and a service desk that cannot be talked into a password reset.

Book a 30-minute call This week's report

PCI DSS 4.0UK GDPRPeak-season readinessStore and online

01The threat picture

The 2025 retail attacks were not sophisticated. They were well-rehearsed.

The Scattered Spider and DragonForce campaign against Marks & Spencer, the Co-op and Harrods in 2025 set the template: a phone call to an outsourced helpdesk, an MFA reset, a pivot into the identity provider, then ransomware across the estate at the worst possible moment. That playbook has been copied by adjacent groups and now baselines the UK criminal ecosystem. Alongside it sit payment-page skimming on Magento and Adobe Commerce storefronts, credential stuffing against loyalty and account portals, DDoS in peak trading windows and the edge-appliance vulnerabilities that give ransomware crews their first foothold. Our weekly retail report tracks all of it and puts the defensive actions in priority order.

Frameworks: PCI DSS 4.0 · UK GDPR · Cyber Essentials Plus · ISO 27001
Estate: Store networks and POS · e-commerce platforms · loyalty and account portals · outsourced service desks · logistics
Intelligence: NCSC · CISA KEV · leak-site monitoring · our own honeypots and IP Insights
Weekly report: Retail — every Friday

What we watch for

How retailers get hit

01Social engineering

Helpdesk pretexting

Callers who know enough to pass as staff and obtain an MFA reset from an outsourced service desk.

02Identity

Identity-provider takeover

From one reset to Okta or Entra ID administration, then to the whole estate.

03E-commerce

Payment-page skimming

Magecart-family injection into checkout pages through platform and plugin vulnerabilities.

04Customer data

Account takeover

Credential stuffing against loyalty and customer accounts, feeding fraud and refund abuse.

05Availability

Peak-season DDoS

Disruption timed to Black Friday, Christmas and the January sales.

06Ransomware

Ransomware across the estate

ESXi-aware encryption of the virtualised estate behind stores, warehouses and online.

How we help

One team across the whole problem

Weekly report

Retail threat intelligence

All insights →

Insights12 October 2026

Britain's exposed controllers: a UK exposure report after the French fridge attack

After Sunday's cyberattack on French supermarket refrigeration, we turned the same question on the UK. Over 800 internet-exposed refrigeration and building-management controllers answer directly to the open internet here, across Danfoss, Carel, Copeland and other vendors, and that figure is a floor rather than a ceiling. Here is what we found, why France was hit and not Britain, and what to do this week.

Peter Bassill9 min read · 136 reads

Insights12 October 2026

Cyberattack defrosts the fridges at hundreds of French supermarkets

Overnight on 11–12 October 2026, attackers reached into the refrigeration controllers of several hundred French supermarkets and switched the fridges and freezers into a defrost cycle that never ended. Intermarché, Coopérative U, Carrefour and Leclerc lost their chilled and frozen stock, the Paris prosecutor has opened an investigation, and the equipment at the centre of it is sitting on the open internet in the UK too.

Peter Bassill11 min read · 182 reads

Threat briefing4 September 2026

Retail threat intelligence report — 29 August – 4 September 2026

Retail remains in a social-engineering-driven era: the Scattered Spider help-desk doctrine, long-running Magecart skimming against major-card payment flows, and the SonicWall SMA1000 zero-day chain dominate the week.

Peter Bassill8 min read · 11 reads

Threat briefing17 July 2026

Retail threat intelligence report — 11–17 July 2026

The retail vertical continues to be shaped by the M&S / Co-op / Harrods retrospective — reclassified by UK observers as a "Category 2 cyber hurricane" with total combined costs assessed at £270m–£440m — and by the continued arrests connected to the DragonForce / Scattered Spider cluster.

Peter Bassill21 min read · 9 reads

Threat briefing10 July 2026

Retail threat intelligence report — 4–10 July 2026

The retail vertical remains defined operationally by the DragonForce / Scattered Spider methodology - voice-phishing IT service desks to reset MFA, help-desk social engineering, aggressive cloud-tenant pivot, and DragonForce ransomware detonation.

Peter Bassill20 min read · 9 reads

Threat briefing3 July 2026

Retail threat intelligence report — 27 June – 3 July 2026

Coverage this period is dominated by the NCA arrests on 30 Jun 2026 of four UK nationals connected to the M&S / Co-op / Harrods DragonForce / Scattered Spider cluster, the CISA KEV addition of CVE-2026-45659 (SharePoint deserialisation RCE)…

Peter Bassill17 min read · 5 reads

Questions

What retailers ask us

Our helpdesk is outsourced. Can you still help?

Yes — this is the most common gap we find. We write the caller-verification procedure, test it with a real pretext call, and monitor for the identity changes that follow a successful one.

Can you monitor our e-commerce platform?

Yes. Platform, WAF and CDN logs join the rest of the telemetry, and skimming, credential-stuffing and checkout-tampering patterns have their own detections.

What about peak?

We run a peak-readiness review in the autumn — patch state, DDoS posture, change freeze, escalation paths — so that November is boring.

Start a conversation

Make November boring.

Thirty minutes on your estate, your service desk and your storefront before the season starts.

Book a 30-minute call

©Trading through peakis the whole point.