In the wake of recent attacks on ASOS, Hobbs and Intermarché, Tom Exelby, head of cyber security at Red Helix, explains how suppliers can be exploited by cyber-criminals targeting retailers.
Recent cyber incidents affecting ASOS and the owner of Hobbs, Phase Eight and Whistles, alongside attacks on supermarket refrigeration systems in France, show how widely retail’s exposure now extends, from customer information to the equipment that keeps stock fit for sale. Years spent connecting systems and outsourcing specialist services have brought considerable efficiencies, but they have also created dependencies that conventional supplier checks may fail to capture.
This helps explain why retail is such an attractive target for cyber criminals. Retailers hold substantial volumes of customer information, including contact details, purchasing histories and loyalty data, while their ability to trade depends on interconnected systems operating reliably. Disruption can affect online orders, store payments, replenishment and deliveries simultaneously, creating immediate commercial pressure. Customers have alternatives, perishable stock has a shelf life, and a missed trading opportunity cannot necessarily be recovered when systems return.
Throughout 2025, one of the most active criminal groups concentrated on UK and US retailers, targeting help desks, identity systems and backup infrastructure. Attackers are also increasingly abusing trusted relationships, including suppliers and software supply chains. Meanwhile, 69% of ransomware attacks in 2025 executed outside business hours, and legitimate remote management tools were abused in 78% of incidents.
Recent attacks show the scale of disruption and damage attacks can have, M&S suspended online and app orders for weeks, and Co-op reported an estimated £206 million in lost sales from its attack. Recovery means more than restoring systems: the business must also deal with interrupted trading, operational backlogs and the task of rebuilding customer confidence. TFG London kept its stores trading while online orders were delayed, showing the value of continuity plans that let parts of the business operate while others recover.
Exposure through suppliers
A common mistake is to assess supplier risk according to the size of the contract rather than the consequences of failure. A relatively small support provider with privileged access may create greater exposure than a much larger supplier with no connection to critical systems. Cyber assurance needs to examine what a supplier can access, what information it holds, and which business activities depend on it.
Retailers should begin by mapping the services needed to take an order, process a payment, replenish a shelf and deliver a purchase, then identify the organisations and systems supporting each stage. This should extend beyond direct suppliers to relevant subcontractors, software integrations and shared infrastructure. Apparently separate providers may depend on the same cloud service or technology partner, creating a concentration of risk that individual supplier assessments miss. Understanding the entire digital supply chain requires following these dependencies rather than stopping at the contractual boundary.
What supplier assurance should deliver
Supplier assurance should then reflect access, data sensitivity and operational importance. The NCSC recommends security requirements proportionate to supplier risk, which means critical relationships deserve more scrutiny than a standard questionnaire. Retailers should seek evidence of secure access controls, effective monitoring and tested recovery arrangements, alongside contractual expectations for incident notification and subcontractor management. Assurance must continue throughout the relationship, particularly when services or permissions change, while unnecessary access should be removed and supplier connections restricted, time-limited and monitored.
Service desks exist to help people, and an urgent request from someone claiming to be a senior employee can exploit that instinct. Following the 2025 retail incidents, the NCSC recommended reviewing identity verification during password resets, particularly for privileged accounts. Retailers should ensure that both internal teams and external support providers follow verification procedures that cannot be bypassed through urgency or seniority, with management backing staff who challenge a convincing request.
Another mistake is treating incident response as purely an IT matter, when preparation must also address the commercial decisions an incident will force. Operations, finance, legal and communications teams should rehearse scenarios alongside IT and critical suppliers, establishing who can disconnect a service, how fulfilment would continue and which capabilities must be restored first. Backups need to be tested against realistic recovery requirements, while monitoring needs someone available to investigate and escalate when internal teams are offline.
Building on existing defences requires an honest view of where they stand. An independent assessment against a recognised framework, such as the NCSC’s Cyber Assessment Framework, shows which controls work in practice rather than on paper. Retailers should then test those controls as attackers would, through red team exercises or simulated help desk calls, prioritise gaps by business impact and repeat the exercise to measure improvement.
The board’s responsibility is to make those dependencies visible and ensure someone owns the consequences. Cyber resilience deserves the same scrutiny as stock availability and margins, supported by evidence that the business can withstand the failure of a system or supplier on which its ability to trade depends.
Stay informed
Our editor carefully curates two newsletters a week filled with up-to-date news, analysis and research. Click here to subscribe to the FREE newsletter sent straight to your inbox. Why not follow us on LinkedIn to receive the latest updates on our research and analysis?
You are in: Home » Guest Comment » GUEST COMMENT Retailers are protecting their systems. Who is protecting the connections?
GUEST COMMENT Retailers are protecting their systems. Who is protecting the connections?
Amanda Vlietstra
In the wake of recent attacks on ASOS, Hobbs and Intermarché, Tom Exelby, head of cyber security at Red Helix, explains how suppliers can be exploited by cyber-criminals targeting retailers.
Recent cyber incidents affecting ASOS and the owner of Hobbs, Phase Eight and Whistles, alongside attacks on supermarket refrigeration systems in France, show how widely retail’s exposure now extends, from customer information to the equipment that keeps stock fit for sale. Years spent connecting systems and outsourcing specialist services have brought considerable efficiencies, but they have also created dependencies that conventional supplier checks may fail to capture.
This helps explain why retail is such an attractive target for cyber criminals. Retailers hold substantial volumes of customer information, including contact details, purchasing histories and loyalty data, while their ability to trade depends on interconnected systems operating reliably. Disruption can affect online orders, store payments, replenishment and deliveries simultaneously, creating immediate commercial pressure. Customers have alternatives, perishable stock has a shelf life, and a missed trading opportunity cannot necessarily be recovered when systems return.
Throughout 2025, one of the most active criminal groups concentrated on UK and US retailers, targeting help desks, identity systems and backup infrastructure. Attackers are also increasingly abusing trusted relationships, including suppliers and software supply chains. Meanwhile, 69% of ransomware attacks in 2025 executed outside business hours, and legitimate remote management tools were abused in 78% of incidents.
Recent attacks show the scale of disruption and damage attacks can have, M&S suspended online and app orders for weeks, and Co-op reported an estimated £206 million in lost sales from its attack. Recovery means more than restoring systems: the business must also deal with interrupted trading, operational backlogs and the task of rebuilding customer confidence. TFG London kept its stores trading while online orders were delayed, showing the value of continuity plans that let parts of the business operate while others recover.
Exposure through suppliers
A common mistake is to assess supplier risk according to the size of the contract rather than the consequences of failure. A relatively small support provider with privileged access may create greater exposure than a much larger supplier with no connection to critical systems. Cyber assurance needs to examine what a supplier can access, what information it holds, and which business activities depend on it.
Retailers should begin by mapping the services needed to take an order, process a payment, replenish a shelf and deliver a purchase, then identify the organisations and systems supporting each stage. This should extend beyond direct suppliers to relevant subcontractors, software integrations and shared infrastructure. Apparently separate providers may depend on the same cloud service or technology partner, creating a concentration of risk that individual supplier assessments miss. Understanding the entire digital supply chain requires following these dependencies rather than stopping at the contractual boundary.
What supplier assurance should deliver
Supplier assurance should then reflect access, data sensitivity and operational importance. The NCSC recommends security requirements proportionate to supplier risk, which means critical relationships deserve more scrutiny than a standard questionnaire. Retailers should seek evidence of secure access controls, effective monitoring and tested recovery arrangements, alongside contractual expectations for incident notification and subcontractor management. Assurance must continue throughout the relationship, particularly when services or permissions change, while unnecessary access should be removed and supplier connections restricted, time-limited and monitored.
Service desks exist to help people, and an urgent request from someone claiming to be a senior employee can exploit that instinct. Following the 2025 retail incidents, the NCSC recommended reviewing identity verification during password resets, particularly for privileged accounts. Retailers should ensure that both internal teams and external support providers follow verification procedures that cannot be bypassed through urgency or seniority, with management backing staff who challenge a convincing request.
Another mistake is treating incident response as purely an IT matter, when preparation must also address the commercial decisions an incident will force. Operations, finance, legal and communications teams should rehearse scenarios alongside IT and critical suppliers, establishing who can disconnect a service, how fulfilment would continue and which capabilities must be restored first. Backups need to be tested against realistic recovery requirements, while monitoring needs someone available to investigate and escalate when internal teams are offline.
Building on existing defences requires an honest view of where they stand. An independent assessment against a recognised framework, such as the NCSC’s Cyber Assessment Framework, shows which controls work in practice rather than on paper. Retailers should then test those controls as attackers would, through red team exercises or simulated help desk calls, prioritise gaps by business impact and repeat the exercise to measure improvement.
The board’s responsibility is to make those dependencies visible and ensure someone owns the consequences. Cyber resilience deserves the same scrutiny as stock availability and margins, supported by evidence that the business can withstand the failure of a system or supplier on which its ability to trade depends.
Stay informed
Our editor carefully curates two newsletters a week filled with up-to-date news, analysis and research. Click here to subscribe to the FREE newsletter sent straight to your inbox. Why not follow us on LinkedIn to receive the latest updates on our research and analysis?
Read More
You may also like
Subscribe to our email community