How do ransomware and cyberattacks on retailers work?
Retailers get hit because they hold lots of customer data and can't easily stop trading, and the public reports so far show disruption but not the attack path.
Covers: This page explains the common attack paths used against retailers, including phishing, credential theft, third-party and supply-chain compromise, and ransomware deployment, plus why retail data and operations are attractive targets. It does not provide instructions for carrying out attacks or specific technical exploits.
Also answers: How do cyberattacks on retailers work? · Why are retailers targeted by ransomware? · How does ransomware affect retail companies? · What is a retail cyberattack?
- One page for this question6 other ways of asking lead here
- 6 independent sourcesEvery claim links to what supports it
- 3 connected pages3 changed this week
- Clean discussionScreened before anything appears
The short answer
Interpretation AI-prepared starting mapRetailers are targeted because they hold large volumes of customer personal data and run operations that cannot easily pause: online stores, payment systems, and store networks. Ransomware is malware that holds a victim's private data hostage, either by encrypting it, stealing it with a threat to publish, or both, with ransoms usually demanded in…123
Read the full explanation and caveats
At a glance
The picture in numbers
Live · updated just now
1,100 major attacks
The evidence behind it
6 sources- Reviews of many studies1
- Other studies and data3
- Background2
When it was published
Newest from 2026
| Source | Kind | Year |
|---|---|---|
| Cyberattacks in supply chains: A multi-case study. | Other studies and data | 2026 |
| Quantifying the Multidimensional Impact of Cyber Attacks in Digital Financial Services: A Systematic Literature Review. | Reviews of many studies | 2025 |
| Impact, Vulnerabilities, and Mitigation Strategies for Cyber-Secure Critical Infrastructure. | Other studies and data | 2023 |
| Cyber security threats: A never-ending challenge for e-commerce. | Other studies and data | 2022 |
| Phase Eight and Hobbs owner hit by cyber-attack, as H&M probes separate hack claim | Background | 2026 |
| Ransomware (Wikipedia) | Background | Unknown |
The community around it
No one has added to this page yet. Firsthand experience, a newer study or a different reading of the numbers would show up here, credited to you.
Did this answer your question?
Be the first to voteIn brief
Ransomware holds data hostage by encrypting it, stealing it with a threat to publish, or both, with ransoms usually demanded in cryptocurrency or stored-value cards because these are harder to trace.1
Evidence-backedThe common entry route is a Trojan disguised as a legitimate file that a user is tricked into opening, often an email attachment, though worms like WannaCry spread automatically without user interaction.1
Evidence-backedE-commerce faces four recurring threat categories: social engineering, denial of service, malware, and attacks on personal data, and attackers keep finding new vulnerabilities in humans, organisations and technology.2
Evidence-backedBreaches can enter through the supply chain and spread: coordination failures between interconnected systems amplify disruption, turning a localised breach into systemic operational paralysis.4
Evidence-backedRecent retail cases such as TFG London (Phase Eight and Hobbs) show the disruption and apology side of an incident, but public reporting so far does not confirm the attack path or whether data was taken.3
Evidence-backed
How concerned are you about ransomware or cyberattacks affecting retailers you shop with?
Your perspective belongs in the picture.Join free to voteAlready a member? Sign inYour individual answer is private. Only totals are shown.
Your turn
Have your say
See where others stand. Join free to add your perspective. One answer per account.
How do you feel about this?
No votes yetQuick questions from connected pages
What it means for you
Which fits you?
Pick the situation closest to yours. Each answer says what it rests on.
If you run an online store and want to reduce your most common exposure
the sources point to reliable technology, training for both employees and consumers, and strong policy and regulation at firm and government level, treated as an ongoing effort rather than a one-off fix.2
Evidence-backedIf your business depends on suppliers or connected systems
resilience appears to emerge only when proactive information sharing is backed by strong internal organisational readiness, so secure architecture, cross-organisational threat intelligence sharing and supplier-support programmes are the levers the evidence points to.4
Evidence-backedIf you are trying to put a number on what a cyberattack would cost your retail business
expect difficulty: impact is quantified with both pre-attack and post-attack techniques and mixed internal and external data, but no standardised taxonomy exists across physical, digital, economic, psychological, reputational and societal dimensions, so figures are not easily comparable.6
Evidence-backedIf you are planning for the next few years of risk
one estimate projects 1,100 major cyber attacks on critical infrastructure worldwide over five years, each causing more than USD 1 million in damages, a significant increase, though that estimate is about critical infrastructure rather than retail specifically.5
Evidence-backedIf you are a customer whose retailer has disclosed an incident
the public reporting on TFG London confirms an incident and an apology for disruption but does not state the cause or whether customer data was taken, so treat unconfirmed details about data theft or ransom demands as unverified until the company or regulators confirm them.3
InterpretationIf you are weighing whether a victim should pay a ransom
the sources note that files can sometimes be recovered without paying because of implementation mistakes, leaked cryptographic keys, or a complete lack of encryption, and that cryptocurrency and stored-value-card payments are harder to trace and prosecute, but they do not establish that paying or refusing is the better outcome.1
Evidence-backedThe full explanation
Interpretation AI-prepared starting mapRetailers are targeted because they hold large volumes of customer personal data and run operations that cannot easily pause: online stores, payment systems, and store networks. Ransomware is malware that holds a victim's private data hostage, either by encrypting it, stealing it with a threat to publish, or both, with ransoms usually demanded in cryptocurrency or stored-value cards because these are harder to trace. A common entry route is a Trojan disguised as a legitimate file that a user is tricked into opening, often as an email attachment, though some attacks such as the WannaCry worm spread automatically between computers without user interaction. Attacks on e-commerce specifically cluster around social engineering, denial of service, malware, and theft of personal data. Recent retail cases show the disruption side: TFG London, owner of Phase Eight and Hobbs, apologised to customers after identifying a "cybersecurity incident" on a Sunday, while H&M was separately probing a hack claim.123
- Evidence 22
- Interpretation 3
The full story · 4 chapters
01
How attacks on retailers typically work
AI summary:Ransomware holds data hostage by encrypting or stealing it, often arriving as a disguised file, and can spread through supply chains.
Evidence-backed: Ransomware is malware that takes a victim's private data hostage until a ransom is paid. It can work by encrypting the data, by exfiltrating it and threatening public release, or both. Payment is typically requested in cryptocurrency or stored-value cards because these are harder to trace, which makes the crime harder to prosecute. Not every victim has to pay: files can sometimes be recovered without payment because of implementation mistakes, leaked cryptographic keys, or a complete lack of encryption in the ransomware itself.1
Evidence-backed: The usual delivery method is a Trojan disguised as a legitimate file that the user is tricked into downloading or opening, often arriving as an email attachment. This is the phishing-style path: the attacker relies on a person clicking. But it is not the only path. The WannaCry worm travelled automatically between computers without any user interaction, showing that once a network is reachable, an attack can spread on its own.1
Evidence-backed: For e-commerce specifically, the recurring threat categories identified are social engineering, denial of service, malware, and attacks on personal data. The same analysis argues that attackers continuously search for new vulnerabilities in three places at once: humans, organisations, and technology, which is why defending e-commerce is described as a never-ending game of cat and mouse rather than a problem that gets solved once.2
Evidence-backed: Attacks also arrive through the supply chain rather than directly. A multi-case study describes Points of Penetration as dynamic transmission mechanisms that convert a localised digital breach into systemic operational paralysis, and finds that disruption is amplified by coordination failures between interconnected systems. In other words, a compromise at one supplier or one connected system can propagate as a lifecycle of entry, transmission, and interruption across the wider network.4
Evidence-backed: A recent retail example shows the disruption pattern without yet showing the mechanism: TFG London, which owns Phase Eight and Hobbs, apologised to customers for disruption after identifying a "cybersecurity incident" on a Sunday, and H&M was separately investigating a hack claim. The public reporting confirms an incident and an apology but does not state the attack path, whether ransomware was involved, or whether customer data was taken.3
02
Why retailers are attractive targets
AI summary:Retailers attract attackers because they store large amounts of personal data and depend on operations that are costly to interrupt.
Evidence-backed: Retail combines two things attackers value: large stores of personal data and operations that are costly to interrupt. The e-commerce literature identifies attacks on personal data as one of the core threat categories facing online retail, alongside social engineering, denial of service and malware, and notes that firms worldwide spend ever-growing amounts on cybersecurity without fully overcoming the problem.2
Evidence-backed: The broader cybercrime economy around these attacks includes money laundering, black markets, and attacks on cyber-physical systems that cause service disruptions, and extensive data breaches have compromised the personally identifiable information of millions of people. This is the market that makes retail data and retail uptime worth attacking.5
Interpretation: Ransomware's dual leverage, encrypt the data or steal it and threaten to publish, fits a business that depends on both continuous trading and customer trust. A retailer that cannot process orders loses revenue immediately, and a retailer whose customer data is threatened with release faces reputational and regulatory exposure. The financial-services review found no standardised way to quantify these multidimensional impacts across physical, digital, economic, psychological, reputational and societal dimensions, so the full cost of a retail attack is hard to state precisely even when the disruption is obvious.16
03
Scale and direction of travel
AI summary:Reported ransomware attacks rose sharply in 2018, and one study projects many costly attacks on critical infrastructure ahead.
Evidence-backed: Reported ransomware volumes have grown sharply: there were 181.5 million ransomware attacks worldwide in the first six months of 2018, 229% more than in the first six months of 2017. Ransomware itself is not new, dating back to the AIDS trojan in 1989, but its use grew internationally from there.1
Evidence-backed: Looking forward, one study estimates that over the next five years 1,100 major cyber attacks will occur on critical infrastructures worldwide, each causing more than USD 1 million in damages, a significant increase on the preceding period. That figure covers critical infrastructure rather than retail specifically, so it should be read as an indication of direction rather than a retail forecast.5
04
What the sources say reduces risk
AI summary:Sources point to reliable technology, training, regulation, information sharing and supplier support, though impact measurement lacks a standard.
Evidence-backed: On the technology and people side, the e-commerce analysis argues that reducing risk requires reliable technology, training of both employees and consumers in using that technology, and strong policy and regulation at both firm and government level. It frames this as an ongoing effort rather than a one-off fix.2
Evidence-backed: On the supply-chain side, the multi-case study finds that resilience emerges only when proactive information sharing is activated by strong internal organisational readiness, and that external relational governance is hierarchically contingent on internal organisational controls. Practically, it points to secure architecture, cross-organisational threat intelligence sharing, and supplier-support programmes as ways to strengthen resilience across complex supply chains.4
Evidence-backed: For measurement and governance, the financial-services review notes that cyber impact is quantified using both pre-attack and post-attack techniques and a mix of internal and external data sources, and that machine learning and deep learning are being applied to cyber security risk quantification. Its central finding, however, is that no standardised taxonomy exists for describing or quantifying impact, which limits how comparable any retailer's loss figures are.6
Before you go
What to remember
The few things worth keeping from this page.
Ransomware holds data hostage by encrypting it, stealing it with a threat to publish, or both, with ransoms usually demanded in cryptocurrency or stored-value cards because these are harder to trace.
The common entry route is a Trojan disguised as a legitimate file that a user is tricked into opening, often an email attachment, though worms like WannaCry spread automatically without user interaction.
E-commerce faces four recurring threat categories: social engineering, denial of service, malware, and attacks on personal data, and attackers keep finding new vulnerabilities in humans, organisations and technology.
Your reading
0 of 4 chaptersThis answer keeps changing
When new evidence or a better source comes in, this page is updated (it's on version 2, last changed 1 hour ago). Follow it to be told when that happens.
Up nextHow do cyberattacks on retailers work and what should customers do after a breach?How do cyberattacks on retailers work, and what should customers do after a data breach?Ask this Sylo
Still wondering about something?
Answers come only from this page's reviewed material, with citations, and say plainly when the page doesn't cover it yet.
Behind this page
Who's adding to it, where it comes from, how it changed and what would make it better. Always open to everyone.
Discussion
Sources
Numbers match the citations in the article. A working link isn't proof that a page supports a claim; check the quoted passage and date.
- 1Ransomware (Wikipedia)WikipediaPublished Oct 14, 2026Checked Oct 14, 2026
“Ransomware is a type of malware that takes the private data of a victim hostage until a ransom is paid. This can involve encryption of the data, and/or exfiltration with the threat of publicly releasing the data. Ransom is typically requested to be paid via cryptocurrency or stored-value cards since these are harder to trace; making the crime more difficult to prosecute. Sometimes the original files can be retrieved without paying the ransom due to implementation mistakes, leaked cryptographic keys or a complete lack of encryption in the ransomware. Ransomware attacks are typically carried out using a Trojan disguised as a legitimate file that the user is tricked into downloading or opening when it arrives as an email attachment. However, one high-profile example, the WannaCry worm, traveled automatically between computers without user interaction. Starting as early as 1989 with the first documented ransomware known as the AIDS trojan, the use of ransomware scams grew internationally. There were 181.5 million ransomware attacks worldwide in the first six months of 2018, 229% more than the first six months of 2017.”
- 2Cyber security threats: A never-ending challenge for e-commerce.Frontiers in psychology (Liu et al.)Published Oct 19, 2022Checked Oct 14, 2026
“Technology applications for e-commerce are attracting attention from both academia and industry. It has made what was not possible before for the business community and consumers. But it did not come all alone but has brought some challenges, and cyber security challenge is one of them. Cyber security concerns have many forms, but this study focuses on social engineering, denial of services, malware, and attacks on personal data. Firms worldwide spend a lot on addressing cybersecurity issues, which grow each year. However, it seems complicated to overcome the challenge because the attackers continuously search for new vulnerabilities in humans, organizations, and technology. This paper is based on the conceptual analysis of social engineering, denial of services, malware, and attacks on personal data. We argue that implementing modern technology for e-commerce and cybersecurity issues is a never-ending game of cat and mouse. To reduce risks, reliable technology is needed, training of employees and consumer is necessary for using the technology, and a strong policy and regulation is needed at the firm and governmental level.”
- 3Phase Eight and Hobbs owner hit by cyber-attack, as H&M probes separate hack claimBBC NewsPublished Oct 13, 2026Checked Oct 14, 2026
“TFG London has apologised to customers for disruption after it identified a "cybersecurity incident" on Sunday.”
- 4Cyberattacks in supply chains: A multi-case study.PloS one (Zhang et al.)Published May 22, 2026Checked Oct 14, 2026
“The scale of disruption is systematically amplified by inter-system coordination failures, while resilience emerges only when proactive information sharing is activated by strong internal organizational readiness. We introduce the concept of synergy dependency, demonstrating that external relational governance is hierarchically contingent on internal organizational controls, and reconceptualize Points of Penetration (PoPs) as dynamic transmission mechanisms that convert localized digital breaches into systemic operational paralysis. This research offers empirically grounded insights that adapt the SCCSS framework from a classificatory tool into a process-oriented model capable of explaining how cyber risk propagates as a lifecycle of entry, transmission, and interruption. The findings contribute analytical interpretations to supply chain governance theory by showing that cyber resilience is conditionally interdependent across subsystems. Practically, the study offers actionable guidance for implementing secure architecture, cross-organizational threat intelligence sharing, and supplier-support programs to strengthen the resilience of complex global supply chain ecosystems.”
- 5Impact, Vulnerabilities, and Mitigation Strategies for Cyber-Secure Critical Infrastructure.Sensors (Basel, Switzerland) (Riggs et al.)Published Apr 17, 2023Checked Oct 14, 2026
“The thriving cybercrime economy encompasses money laundering, black markets, and attacks on cyber-physical systems that result in service disruptions. Furthermore, extensive data breaches have compromised the personally identifiable information of millions of people. This paper aims to summarize some of the major cyber attacks that have occurred in the past 20 years against critical infrastructures. These data are gathered in order to analyze the types of cyber attacks, their consequences, vulnerabilities, as well as the victims and attackers. Cybersecurity standards and tools are tabulated in this paper in order to address this issue. This paper also provides an estimate of the number of major cyber attacks that will occur on critical infrastructure in the future. This estimate predicts a significant increase in such incidents worldwide over the next five years. Based on the study's findings, it is estimated that over the next 5 years, 1100 major cyber attacks will occur on critical infrastructures worldwide, each causing more than USD 1 million in damages.”
- 6Quantifying the Multidimensional Impact of Cyber Attacks in Digital Financial Services: A Systematic Literature Review.Sensors (Basel, Switzerland) (Adekoya et al.)Published Jul 11, 2025Checked Oct 14, 2026
“This paper presents a systematic review and examination of the state of the art in cyber impact quantification, with a particular focus on digital financial organisations. Based on a structured search strategy, 44 articles (out of 637) were selected for in-depth analysis. The review investigates the terminologies used to describe cyber impacts, categorises current quantification techniques (pre-attack and post-attack), and identifies the most commonly utilised internal and external data sources. Furthermore, it explores the application of Machine Learning (ML) and Deep Learning (DL) techniques in cyber security risk quantification. Our findings reveal a significant lack of standardised taxonomy for describing and quantifying the multidimensional impact of cyberattacks across physical, digital, economic, psychological, reputational, and societal dimensions. Lastly, open issues and future research directions are discussed. This work provides insights for researchers and professionals by consolidating and identifying quantification technique gaps in cyber security risk quantification.”
How it changed
Published 1 time since Oct 14, 2026.
- Version 2Oct 14, 2026Live now
AI-prepared Starting Map from live research.
- First published version.
Help improve it
The brief is open about what's uncertain. These are the specific gaps that new material would fill.
Open questions
Which attack paths dominate in retail specifically, and how do they differ between online-only, store-based, and omnichannel retailers? The available studies cover e-commerce and supply chains generally rather than retail as a sector.
No answers yet
How often do retail victims pay, and how often do they recover data without paying through implementation mistakes, leaked keys, or unencrypted files?
No answers yet
What is the full cost of a retail cyberattack once reputational, psychological and societal effects are included, given that no standardised taxonomy for quantifying these dimensions currently exists?
No answers yet
Which specific measures, employee and consumer training, secure architecture, threat intelligence sharing, or supplier-support programmes, measurably reduce incident frequency or severity in retail?
No answers yet
Around this topic
Sylos connect: narrower topics report up to broader ones, so what's learned in one place shows up where it matters.