The Medibank cyberattack has taken the heat off a data breach at Woolworths’ new online marketplace, MyDeal, but retailers remain on high alert after a string of hacks that have stolen the data of more than 16 million consumers in a month.
With their reams of personal and credit card data from loyalty schemes, e-commerce sites, online marketplaces, subscription-based delivery services and point of sale systems, retailers have emerged as irresistible targets for hackers.
The shift from cash to credit cards and digital wallets, and the implementation of multiple technologies as retailers digitise their operations and move from bricks and mortar to online, have given cyber criminals ever more ways to exploit the sector’s defences.
Cybersecurity experts say the $400 billion sector’s so-called “attack surface” – the outward-facing parts of their business that can be accessed and exploited – is growing as retailers seek to boost sales by making more targeted offers to customers, collaborate with suppliers and partners, and reduce costs by implementing new data-driven technologies.
“The breaches we’ve seen recently are a wake-up call for all businesses to ensure they’re doing everything they can to safeguard customer information,” says Australian Retailers Association chief executive Paul Zahra. “Cybersecurity remains a huge focus for retailers and will require ongoing attention.”
Arjun Ramachandran, principal at cybersecurity firm elevenM, says retailers are being specifically targeted because they hold large stores of valuable data, and their data protection and cybersecurity systems might not be as robust as those in other sectors such as banking and telecommunications.
“Retailers have always had to hold and handle financial and transactional data like payment information and credit cards, but the recent breaches have illuminated the broader value of the customer data they hold to hackers and attackers,” Ramachandran says.
While four million Medibank Private customers are understandably worried about the theft of confidential health information, major retailers such as Woolworths, Coles, Wesfarmers, Endeavour Group and Myer are storing vast amounts of customer data that is equally sensitive, ranging from their names, addresses, phone numbers, drivers’ licences and date of birth to the pharmaceuticals and health care products they use, the amount of alcohol they consume and even the size of their bras and underpants.
Retailers claim their loyalty data is de-identified, but if their systems can identify customers by name and email address and track their spending, it’s not hard to imagine increasingly sophisticated hackers will find ways to put two and two together.
“De-identification is not a panacea,” says Ramachandran. “There’s plenty of research showing that information that’s been purportedly de-identified has been very readily re-identified. That’s an incredible risk.”
Ten years ago The New York Times published an article revealing that US retailer Target was using predictive analytics to pinpoint when customers became pregnant – even before they had told their families – and predict their due date based on changes in their spending habits. Target sent them coupons and offers including discounts on maternity wear, vitamins and nappy bags.
Most large retailers are now using predictive analytics to track and forecast customer spending, but to do so accurately they need more customer data. This data is gold in the hands of cybercriminals, who sell the information on the dark web, rack up bills on credit cards, steal identities to commit other crimes, or withhold the data and hold companies to ransom.
Customers trust their data will be protected and when this trust is broken, they are likely to stop scanning loyalty cards – depriving retailers of precious insights – or stop shopping with the retailer altogether.
Hackers moved too quickly
It’s too early to tell if the cyberattack on online marketplace MyDeal, barely a month after Woolworths acquired an 80 per cent stake, will deter customers and lead to a decline in sales.
Woolworths’ chief security officer Pieter van der Merwe, told The Australian Financial Review last week the retailer had started strengthening MyDeals’ cybersecurity systems after identifying areas of weakness during due diligence for the acquisition.
But the hackers moved too quickly, breaching MyDeal’s customer relationship management system in mid-October. About half of the 2.2 million customers affected had their email addresses exposed. For the other half, names, phone numbers, addresses and birthdates were exposed, but no payment details, passwords, drivers’ licences or passport details were accessed.
Woolworths chief executive Brad Banducci apologised at the annual meeting on Wednesday, saying the retailer took cybersecurity and data privacy seriously.
“We were weeks away from all the remedial action being done to lift it to the standard we would expect at Woolworths. It wasn’t that it was a poor standard, but there were things to be done,” Banducci said.
“But as a major public company, we are going to be targeted. Going forward, if we ever found ourselves in this situation again, we’d make sure that at the point of completion it was at our standard, the work was under way to get to our standard. So, it has been a real lesson for us.”
Woolworths is doubling its spending on cybersecurity and core IT, testing APIs (the apparent entry point hackers used to penetrate Optus’ defences), testing penetration protections and reviewing all its datasets and data retention policies.
“This is an area we have to be absolutely vigilant over all the time and you can’t relax,” said outgoing Woolworths chairman, Gordon Cairns.
Coles is also reviewing cybersecurity following the MyDeal, Optus and Medibank and Vinomofo attacks.
“As soon as something happens we look at what’s happened and are we exposed in the same way or not,” says Coles chief executive Steven Cain.
“It’s a continuous investment program. No one is bulletproof. The hackers are becoming more sophisticated over time as well.”
Many major companies, including Coles, benchmark themselves against the Australian Cyber Security Centre’s Essential Eight framework, which outlines a minimum set of preventative measures designed to make it harder for adversaries to compromise systems.
However, Essential Eight will not mitigate all cyber threats and the ACSC says organisations may need to implement additional measures and security controls where they are warranted by their environment.
The Essential Eight mitigation strategies include patching applications and operating systems, restricting administrative privileges, regular system backups and implementing multifactor authentication, including one-time codes to supplement passwords and usernames.
“A lot of organisations recognise its value and commit to applying it, but many find it difficult to achieve full maturity against all eight measures,” says Ramachandran.
It appears that in the Medibank and MyDeal attacks, data was accessed by unauthorised users using “compromised” or through stolen credentials. This suggests multifactor authentication was not implemented, or the hackers found ways to bypass these protections, perhaps by accessing the details of a contractor or supplier with access to systems.
Nine years ago, US retailer Target’s point-of-sale systems were breached when the user account of an air-conditioning mechanic was compromised. The attackers used his account to work their way through other systems, eventually stealing customer credit card details.
Many retailers rushed to digitise and enable employees and suppliers to work from home and access their systems remotely during the pandemic, opening up more potential points of attack.
“Supply chain security is really hard one – it’s hard enough for organisations to understand their own organisation’s security and fix it, now they have to think about the suppliers they’re using as well,” says Ramachandran.
Experts say multifactor authentication is crucial, but retailers also need to invest in training so employees, contractors and suppliers are aware of risks such as phishing emails designed to steal passwords and suspicious behaviour, such as staff seeking more access to sensitive information and systems. Retailers should also adopt the concept of least privilege, where individuals only have access to systems they need to do their jobs.
While MyDeal, Medibank, Optus and Vinomofo have attempted to absolve themselves of blame, pointing the finger at cybercriminals, consumers will hold businesses accountable for safeguarding the data they hold and will punish those that fail to protect it.
If the loss of customer trust isn’t punishment enough, hefty remediation and compensation costs, the potential loss of precious customer data and new fines ranging from $50 million to as much as 30 per cent of revenues might prompt retailers to take cybersecurity even more seriously.