What should companies and customers do after a retail cyber-attack?

Numbers match the citations in the article. A working link isn't proof that a page supports a claim; check the quoted passage and date.

1. 1

   Data breach (Wikipedia)

   WikipediaPublished Oct 11, 2026Checked Oct 13, 2026

   “A data breach, also known as a data leak, is "the unauthorized exposure, disclosure, or loss of personal information". Attackers have a variety of motives, from financial gain to political activism, political repression, and espionage. There are several technical root causes of data breaches, including accidental or intentional disclosure of information by insiders, loss or theft of unencrypted devices, hacking into a system by exploiting software vulnerabilities, and social engineering attacks such as phishing where insiders are tricked into disclosing information. Although prevention efforts can reduce the risk of a data breach, they cannot eliminate it. A large number of data breaches are never detected. If a breach becomes known to the company holding the data, post-breach efforts commonly include containing the breach, investigating its scope and cause, and notifications to people whose records were compromised, as required by law in many jurisdictions. Law enforcement agencies may investigate breaches, although the hackers responsible are rarely caught. Criminals often sell data obtained in breaches on the dark web.”

2. 2

   Cyberattacks in supply chains: A multi-case study.

   PloS one (Zhang et al.)Published May 22, 2026Checked Oct 13, 2026

   “The scale of disruption is systematically amplified by inter-system coordination failures, while resilience emerges only when proactive information sharing is activated by strong internal organizational readiness. We introduce the concept of synergy dependency, demonstrating that external relational governance is hierarchically contingent on internal organizational controls, and reconceptualize Points of Penetration (PoPs) as dynamic transmission mechanisms that convert localized digital breaches into systemic operational paralysis. This research offers empirically grounded insights that adapt the SCCSS framework from a classificatory tool into a process-oriented model capable of explaining how cyber risk propagates as a lifecycle of entry, transmission, and interruption. The findings contribute analytical interpretations to supply chain governance theory by showing that cyber resilience is conditionally interdependent across subsystems. Practically, the study offers actionable guidance for implementing secure architecture, cross-organizational threat intelligence sharing, and supplier-support programs to strengthen the resilience of complex global supply chain ecosystems.”

3. 3

   Disaster risk management and SME resilience in low- and middle-income countries: A systematic review and evidence map.

   Jamba (Potchefstroom, South Africa) (Mtetwa & Kubheka)Published May 7, 2026Checked Oct 13, 2026

   “The findings indicate that simplified versions of internationally recognised frameworks, particularly ISO-aligned risk management, COSO-based enterprise risk management and business continuity toolkits, are most frequently adopted by SMEs. Across sectors and regions, these approaches are associated with improved preparedness, increased risk awareness and shorter recovery times following disruptions. However, evidence linking adoption to sustained financial performance or long-term resilience remains limited. The review also highlights important gaps in the evidence base, including limited use of causal research designs, reliance on self-reported measures and the underrepresentation of micro, informal and women-owned enterprises.ContributionDespite these limitations, the findings suggest that proportionate and context-sensitive practices can strengthen SME preparedness and recovery capacity. Policymakers and support institutions should promote accessible guidance, phased adoption pathways and practical continuity tools to better integrate SME resilience into local disaster risk reduction strategies.”

4. 4

   Quantifying the Multidimensional Impact of Cyber Attacks in Digital Financial Services: A Systematic Literature Review.

   Sensors (Basel, Switzerland) (Adekoya et al.)Published Jul 11, 2025Checked Oct 13, 2026

   “This paper presents a systematic review and examination of the state of the art in cyber impact quantification, with a particular focus on digital financial organisations. Based on a structured search strategy, 44 articles (out of 637) were selected for in-depth analysis. The review investigates the terminologies used to describe cyber impacts, categorises current quantification techniques (pre-attack and post-attack), and identifies the most commonly utilised internal and external data sources. Furthermore, it explores the application of Machine Learning (ML) and Deep Learning (DL) techniques in cyber security risk quantification. Our findings reveal a significant lack of standardised taxonomy for describing and quantifying the multidimensional impact of cyberattacks across physical, digital, economic, psychological, reputational, and societal dimensions. Lastly, open issues and future research directions are discussed. This work provides insights for researchers and professionals by consolidating and identifying quantification technique gaps in cyber security risk quantification.”

5. 5

   Phase Eight and Hobbs owner hit by cyber-attack, as H&M probes separate hack claim

   BBC NewsPublished Oct 13, 2026Checked Oct 13, 2026

   “TFG London has apologised to customers for disruption after it identified a "cybersecurity incident" on Sunday.”