Retail Under Attack: Why Network Security Must Be a Business Priority

Recent cyberattacks are exposing the vulnerabilities that exist across modern retail. From compromised employee accounts to disrupted IT systems and vulnerable connected devices, retailers need to look beyond the perimeter and strengthen security across their entire environment.

Retailers have become increasingly dependent on connected technology to keep their businesses running. Online stores, payment systems, stock management, warehouse operations, customer databases and in-store networks all play a role in delivering a seamless customer experience.

But this connectivity also creates risk.

The latest wave of cyber incidents affecting UK retailers is a reminder that an attack does not need to take down an entire business to cause significant disruption. A compromised account, an exposed system or a weakness in a third-party platform can be enough to affect operations, interrupt sales and undermine customer confidence.

With retailers including ASOS and the brands owned by The Foschini Group — Hobbs, Whistles and Phase Eight — reporting cyber incidents in October 2026, alongside the continuing impact of previous high-profile attacks, the message is clear: cybersecurity must be treated as an essential part of retail operations, not simply an IT consideration.

The latest retail cyberattacks: What can we learn?

The recent incidents demonstrate how different types of security weaknesses can create serious business consequences.

Compromised access can expose more than one system

ASOS reported that some customer personal information may have been accessed following the compromise of an employee’s credentials through impersonation of a trusted contact. The incident involved third-party platforms used by the retailer, highlighting how access to one account can create exposure beyond an organisation’s immediate infrastructure. ASOS stated that it did not believe payment card details or account passwords had been affected. (Reuters, 8 October 2026).

For retailers, this reinforces the importance of protecting employee identities, controlling access to business applications and reviewing the permissions granted to external platforms and service providers.

IT disruption can affect trading even when stores remain open

In October 2026, The Foschini Group reported a cybersecurity incident affecting certain IT systems associated with its UK retail brands, Hobbs, Whistles and Phase Eight. The company activated its incident response and business continuity plans while investigating the incident. Its stores remained open, although some systems were unavailable. (Retail Gazette, 13 October 2026).

The distinction is important. A retailer can continue trading while still experiencing significant operational disruption. If stock visibility, order processing, fulfilment or internal communications are affected, the consequences can quickly extend across the business.

Connected devices can become an unexpected point of entry

Recent attacks affecting supermarkets in France have also highlighted the security risks associated with connected operational technology. Reports described disruption to refrigeration systems after attackers exploited weaknesses in remotely accessible control systems. UK reporting has raised concerns about similar exposure affecting supermarket refrigeration equipment.

These incidents demonstrate that network security extends beyond traditional IT systems. Devices responsible for refrigeration, building management and other operational functions can also create risks when they are exposed to the internet or inadequately protected. (Associated Press, 13 October 2026; The Grocer, 13 October 2026).

For retailers, the challenge is understanding what is connected, how it communicates and whether it can be accessed through an insecure route.

Why network security matters more than ever in retail

Modern retail environments are complex. A single organisation may operate a head office, distribution centres, warehouses, hundreds of stores, multiple cloud platforms and a growing number of third-party integrations.

Each location introduces connectivity requirements and potential security considerations.

Without appropriate controls, weaknesses in one part of the environment may provide a route towards systems that should remain protected.

A robust network security strategy should address five key areas.

1. Protecting the network perimeter

Firewalls remain a fundamental part of retail security, controlling traffic entering and leaving networks and helping enforce access policies between environments.

However, simply having a firewall in place is not enough. Rules must be reviewed, unnecessary access removed, firmware maintained and configurations aligned with the organisation’s current infrastructure.

Retailers expanding their estates, opening new sites or adopting additional cloud services should regularly assess whether their existing firewall architecture still provides appropriate protection.

A poorly maintained perimeter can create unnecessary exposure, particularly when remote access services and management interfaces are accessible from external networks.

2. Segmenting stores, systems and devices

Network segmentation is particularly important for retailers operating distributed environments.

Point-of-sale systems, corporate devices, guest Wi-Fi, CCTV, building management systems and operational technology should not automatically have unrestricted access to one another.

Separating these environments helps limit the routes available to an attacker and reduces the potential impact of a compromised device.

For example, if a device on a guest network is compromised, appropriate segmentation should prevent that device from reaching sensitive business systems.

The same principle applies across stores, warehouses and head offices. Retailers should assess which systems genuinely need to communicate and restrict access accordingly.

Segmentation is not just a technical improvement. It is a practical way to reduce the potential scale of an incident.

3. Securing Wi-Fi across the retail estate

Wi-Fi is essential to modern retail operations. Staff devices, handheld stock scanners, inventory systems, guest connectivity and connected equipment may all rely on wireless infrastructure.

But as networks expand, so does the need for consistent security.

Retailers should review wireless access controls, authentication, network separation and monitoring. Guest connectivity should be isolated from internal business systems, while staff and operational devices should receive access appropriate to their roles.

Legacy wireless infrastructure can also introduce challenges, particularly where equipment no longer receives security updates or struggles to support modern authentication requirements.

A planned Wi-Fi refresh can provide an opportunity to improve both connectivity and security, rather than simply replacing ageing hardware.

4. Improving visibility and threat detection

Prevention is essential, but retailers also need to understand what is happening across their environments.

Endpoint detection and response (EDR) and extended detection and response (XDR) can help identify suspicious activity on devices and correlate security signals across supported systems. Network monitoring and security analytics can provide additional visibility into unusual traffic, unauthorised connections and potential lateral movement.

This matters because attackers may attempt to move between systems after gaining initial access, making it important to identify suspicious behaviour before it develops into a wider incident.

Retailers should consider whether their current security tools provide sufficient visibility across stores, remote users, cloud services and central infrastructure — and whether alerts are being investigated and acted upon effectively.

5. Managing third-party and remote access

Retail businesses depend on external suppliers for everything from payment services and e-commerce platforms to infrastructure maintenance and refrigeration support.

These relationships can introduce additional access paths into the environment.

Third-party accounts should be individually identifiable, protected by strong authentication and restricted to the systems and services required for the work being performed. Remote access should be controlled, monitored and removed when it is no longer needed.

Retailers should also review how service providers access management interfaces and operational devices. Remote management should not mean unrestricted access from the public internet.

The objective is not to eliminate third-party relationships, but to ensure they do not introduce unnecessary risk.

Security must support business continuity

For retailers, the impact of a cyberattack is rarely limited to the technology team.

Disruption can affect sales, stock availability, fulfilment, customer service, supplier relationships and the ability to operate stores effectively. Recovery can also require significant time and resources, even after the initial incident has been contained.

This is why cybersecurity and business continuity should be considered together.

Retailers should understand which systems are essential to trading, how operations would continue if those systems became unavailable and how quickly critical services could be restored.

Practical preparation should include:

• Reviewing incident response and business continuity plans.
• Testing backups and recovery procedures.
• Identifying dependencies between IT systems and operational technology.
• Confirming who is responsible for decisions during a cyber incident.
• Ensuring external support and specialist expertise can be accessed when required.
• Regularly reviewing vulnerabilities, access permissions and security configurations.

These measures help organisations prepare for disruption rather than relying on improvised responses when an incident occurs.

Where should retailers start?

Strengthening retail security does not necessarily mean replacing every existing system or investing in the latest technology immediately.

A more effective starting point is to understand the current environment, identify the most significant weaknesses and prioritise improvements according to risk.

For some retailers, this may mean reviewing firewall configurations and remote access. For others, it may involve improving network segmentation, replacing unsupported Wi-Fi infrastructure, strengthening endpoint protection or gaining better visibility across distributed sites.

A structured security review can help establish where gaps exist, how systems interact and which improvements will have the greatest impact.

It can also help organisations avoid unnecessary duplication, making better use of the technologies and resources they already have.

The key is to take a joined-up approach. Firewalls, wireless infrastructure, endpoint protection, vulnerability management and identity security should work together as part of a wider strategy, rather than operating as disconnected solutions.

How ANSecurity can help

At ANSecurity, we help organisations strengthen their network security, reduce exposure and build more resilient IT environments.

With more than 23 years of experience in network security and cybersecurity, we work alongside customers to understand their infrastructure, identify areas of risk and develop practical recommendations aligned with their priorities and budgets.

Our vendor-agnostic approach means recommendations are based on the organisation’s requirements, rather than a one-size-fits-all solution.

For retail businesses, this can include firewall reviews and optimisation, network segmentation, secure Wi-Fi, infrastructure refresh projects, vulnerability management, endpoint security and threat detection and response.

Whether you operate a single retail site or a geographically distributed estate, understanding how your systems connect — and how an attacker might exploit those connections — is an important step towards improving security.

Conclusion: Retail security starts with understanding your network

The recent attacks are a reminder that retail cybersecurity is about much more than protecting an online checkout or installing antivirus software.

It means understanding the connections between stores, people, devices, suppliers and business systems — and ensuring those connections are appropriately secured.

As retailers continue to adopt new technologies and expand their digital operations, network security must evolve alongside them.

The organisations best placed to manage this risk will be those that take a proactive approach: reviewing their infrastructure, controlling access, improving visibility and preparing for incidents before they happen.

Is your retail network ready for the next attack?

ANSecurity can help you assess your current environment, identify security gaps and prioritise practical improvements to strengthen your defences.

Contact ANSecurity to discuss your network security requirements.