A new Kaspersky survey has revealed that 87% of retailers experienced cyber incidents over the past 12 months, highlighting the growing cybersecurity challenges facing an industry increasingly dependent on digital services, artificial intelligence and personalized customer experiences.
The study, conducted by Kaspersky’s Internal Research Center, surveyed IT security specialists across 18 countries to examine the threats targeting the retail sector, the objectives behind cyberattacks and the potential impact on businesses.
The research covered companies with more than 100 employees across different industries and included 1,800 IT security specialists and management representatives. Retail organizations accounted for 120 respondents.
Phishing remains the leading threat
Retailers are increasingly relying on e-commerce platforms, loyalty programs and personalized digital offerings, creating extensive flows of customer and employee data across the transaction lifecycle.
According to the survey, only 13% of retailers avoided cyber incidents during the previous year.
Phishing was the most frequently reported threat, affecting 21% of retailers. Other social engineering attacks included deepfakes and invoice or payment fraud, at 13% each, followed by business email compromise at 9% and vishing, or voice phishing, at 8%.
Cyber espionage was reported by 19% of retailers, while web application exploits affected 18%, placing both among the most frequently experienced types of incidents.
The research also found that attackers primarily sought to obtain customers’ personal data, cited by 34% of respondents, while employee personal data was identified as a target by 28%.
Cyber incidents are causing significant business losses
The consequences of cyberattacks extend beyond data theft. Customer personal data theft was reported as an actual outcome by 28% of retailers, while financial losses and disruption to business and operational processes each accounted for 25%.
More severe incidents resulted in irrecoverable data loss for 19% of retailers and irreversible damage to corporate assets or systems for 16%.
Following their most damaging security incidents, retailers adopted several measures to strengthen their defenses. The most common included implementing Zero Trust or the Principle of Least Privilege for employees, partners and contractors, reported by 31% of organizations.
Strengthening cloud security controls and deploying IT security monitoring solutions were each reported by 30% of respondents.
Human behavior remains a key security concern
The survey also highlighted internal factors that can increase the likelihood of successful cyberattacks.
Insufficient expertise among IT and security personnel and a lack of security awareness were each cited by 27% of respondents as key concerns. Technical weaknesses were also significant, with outdated software or hardware and a lack of centralized control over IT infrastructure each reported by 23%.
Unsafe employee behavior remains another area of concern. Some 34% of respondents said colleagues use personal devices for work-related activities and store corporate data on them.
Meanwhile, 33% of companies reported irresponsible password practices, including the use of weak or reused passwords, as well as connecting corporate devices to public Wi-Fi networks without a secure connection.
Retailers increase cybersecurity spending
As cyber risks continue to evolve, 82% of retailers surveyed said they increased their IT security budgets this year.
The sector is also increasingly relying on external cybersecurity providers rather than expanding internal IT teams. Some 41% of retailers allocated additional funding to outsource specific security functions, including employee training, managed security services, managed detection and response, and data protection technologies.
Elizaveta Komarova, Solution Architect, Finance & Retail at Kaspersky, said the highly dynamic nature of retail means that business priorities, workloads, infrastructure requirements and economic conditions can change rapidly.
According to Komarova, working with external security providers can give retailers access to specialized expertise and technologies without requiring continuous expansion of their internal teams.
She also emphasized the importance of selecting providers with proven experience across retailers of different sizes and maintaining 24/7/365 protection, particularly during seasonal sales, periods of increased consumer demand and holidays, when operational disruptions can be particularly costly.
AI adoption is gaining momentum
Artificial intelligence is also becoming increasingly integrated into retail infrastructure.
Kaspersky found that 12% of retailers already have a working tool based on large language models, while 83% are still discussing, designing or piloting such technologies.
Despite the growing adoption of AI, 33% of retail companies said they do not see any risks associated with the technology. This compares with 18% across all industries surveyed.
Kaspersky outlines key cybersecurity measures
To reduce the likelihood and business impact of cyber incidents, Kaspersky recommends that retailers strengthen their overall cybersecurity culture through continuous employee awareness and training programs.
The company also advises organizations to establish or update policies governing the use of AI tools, including clear rules on the types of data employees can enter into AI systems, how sensitive information should be anonymized and which AI services are approved for use.
Retailers should also identify their most valuable assets and critical business processes, including customer data, intellectual property, core applications and supply-chain workflows, and ensure they receive appropriate protection.
Kaspersky further recommends regularly assessing the cybersecurity landscape within the retail sector, identifying likely attackers and vulnerabilities that could have the greatest impact on operations.
Finally, retailers should strengthen endpoint protection across workstations, laptops and mobile devices and ensure that security solutions are continuously updated to address emerging threats.
