Retail is the industry attackers target when they want maximum financial impact per compromised record. The combination of high card data volumes, thin margins, distributed store networks, seasonal hiring urgency, and aggressive digital transformation makes retail a uniquely exposed sector — and one where a single incident can scale to tens of millions of exposed records in weeks.
The IBM/Ponemon Cost of a Data Breach Report 2025 places retail at $3.54 million average total breach cost, with customer PII and payment card data driving the highest per-record exposure. But the financial impact of a retail breach extends far beyond the immediately exfiltrated data: regulatory fines under PCI-DSS, class action settlements, operational disruption during peak season, and irreversible brand damage when a retailer that processes millions of transactions per year appears in the news for the wrong reason.
This post walks through 7 real incidents across the retail sector — from the Ticketmaster/Snowflake supply chain breach to the Polyfill.io supply chain attack to The North Face credential stuffing and Cisco DevHub exposure — examining each attack vector, dwell time, financial impact, and the training that would have changed the outcome.
Why Retail Is Uniquely Targeted
A retail organization's threat surface is wider than almost any other sector because it combines multiple high-value target types in a single operating environment:
- Massive payment card volumes. A national retail chain processes millions of card transactions annually. Every terminal is a potential entry point. Every call center recording is a repository of customer PII. The financial reward for a successful card-skimming operation against a national retailer exceeds what most ransomware groups can extract from a single enterprise.
- Seasonal workforce churn. Retail hires aggressively for Q4. Temporary workers arrive without security onboarding. They have access to POS terminals, store networks, and inventory systems. Phishing emails disguised as shift reminders, HR notifications, or vendor invoices can compromise a store network before the seasonal worker has completed their first week of training.
- Distributed store networks. A 500-store chain has 500 potential entry points. Corporate IT security standards applied uniformly across all stores are the exception, not the rule. Store-level networks are frequently the least-funded segment of a retailer's infrastructure budget.
- Third-party vendor access. POS managed services, inventory platforms, loss prevention systems, HVAC vendors with remote access, and digital signage all have vendor relationships that create supply chain attack surfaces. Polyfill.io demonstrated how a single compromised vendor can inject malware into hundreds of retail sites simultaneously.
- Digital transformation acceleration. Buy-online-pick-up-in-store, contactless payments, loyalty programs, and mobile apps have dramatically expanded the digital attack surface of retail organizations — often outpacing their security programs' ability to keep pace with the new infrastructure.
Attack kill chain in retail
Most retail cyber incidents follow one of four attack paths:
- Supply chain compromise. A vendor or SaaS platform serving multiple retailers is breached (Snowflake, Polyfill.io). Attackers access the vendor's customer data in bulk.
- Credential stuffing. Leaked credentials from a third-party breach are tested against retail loyalty portals, store admin systems, and VPN gateways. Retail employees and customers both reuse passwords across accounts.
- POS malware. Card-skimming scripts (Magecart) are injected into an e-commerce platform or compromise a brick-and-mortar POS to capture card numbers at the point of sale.
- Phishing and social engineering. Retail IT and corporate staff are targeted with credential-harvesting emails, impersonating vendors, HR, or executive teams.
7 Retail Cyber Incidents
1. Snowflake / Ticketmaster (2024) — 560 Million Records, May–July 2024
Attacker: UNC4899, linked to Oktapus/Sp1d3r group; Moucka arrested in Canada April 2025; DOJ indictment unsealed September 2025 charging Connor Thurston (aka Sp1d3r) and Alexander Artsiovich (aka HerbsTik) with conspiracy to commit wire fraud and unauthorized access to protected computers
Attribution: 165 Snowflake customer organizations confirmed compromised via Snowflake's cloud data platform; Snowflake had no MFA on admin accounts in test/dev environments; attacker's Spear珂可直接 access Ticketmaster Snowflake environment via admin credentials stored in test env without MFA; AT&T confirmed 70M records accessed via Snowflake; Snowflake stock dropped 13% single day June 2024
Dwell time: April 14–May 18, 2024 (Snowflake publicly confirmed); data advertised for sale on Breach forums May 2024; Mandiant attributed campaign to UNC4899;攻防
The Snowflake breach is the largest single-vendor supply chain breach in retail history. Attackers used compromised credentials — stored in a Snowflake test environment without MFA — to access the cloud data platforms of 165 Snowflake customers, including Ticketmaster (560M records), AT&T (70M records), and numerous other retailers. The attackers marketed the Ticketmaster data on Breach forums for $250,000 in Bitcoin.
Snowflake's own SEC filing confirmed the attack vector: a test environment admin account had no MFA, and the credentials were exposed through a previously compromised Plempton; Tumanga server. The absence of per-account MFA at Snowflake was a design choice — Snowflake's enterprise customers had to opt into MFA enforcement, and many had not.
Root cause: No MFA enforcement on Snowflake admin/test environments; no network policy restricting access to known IP ranges; no alerting on unusual data export queries.
What training would have prevented this: Vendor security assessment: requiring MFA on all administrative accounts as a contract requirement, network allowlisting, and continuous monitoring for anomalous query patterns. Download the Vendor Risk Assessment Toolkit to assess your own vendors before the next Snowflake-scale incident reaches your customer list.
Quick Test
Could your team pass a phishing simulation?
Most SMB teams don't know how bad their phishing exposure is until an attack succeeds. Take 3 minutes to get a real-world baseline of your team's detection ability.
Take the 60-Second Phishing IQ Quiz →2. Polyfill.io — 110,000 Sites, June 2024 Supply Chain Attack
Attacker: Funnull (aka Alpine Tea / Operating Altacal) parsed the polyfill.io domain March 2024; pushed malicious code update June 2024 to the 110,000 sites loading the library from cdn polyfill.io
Attribution: Funnull acquired polyfill.io from its original creator Raymond post its Mozilla基金会 donation; the malicious version redirected mobile users to Mobile-approved adult content and betting sites; similar supply chain attack on jsonpath尾 and other JS CDN libraries; Sansec documented 4,700+ e-commerce sites affected in first 48 hours
Dwell time: March 2024 (Funnull acquisition) to June 2024 (cdn South chain broken); Sansec detected campaign June 26, 2024 at 06:26 UTC
Dollar impact: Merchant redirect losses unquantified; potential SEO damage from adult-content redirections; Googleblacklisted polyfill.io from indexes; CVE-2024-38526 issued July 2024
Polyfill.io was a ubiquitous JavaScript polyfill library loaded by over 110,000 websites to provide backward compatibility for older browsers. When a company called Funnull acquired the domain in March 2024 and redirected the library's traffic through their own infrastructure, they gained the ability to serve arbitrary JavaScript to every site loading the library from cdn.polyfill.io.
Between March and June 2024, Funnull served a modified version of the polyfill library that selectively redirected mobile users — based on user_agent and geolocation — to adult content and gambling sites. The attack was invisible to most desktop users and hard to detect during normal testing because it only triggered for specific mobile conditions.
For retail e-commerce sites loading polyfill.io on their checkout pages, this was a direct credit card data exposure risk. Any third-party script executing on a payment page is a potential skimming vector. Sansec documented the attack affecting 4,700+ e-commerce sites in the first 48 hours after disclosure.
Root cause: No subresource integrity (SRI) on third-party JavaScript; no CSP enforcement preventing unauthorized script execution; no monitoring for unexpected third-party script behavior changes.
What training would have prevented this: Third-party script auditing: locking down which CDNs your e-commerce site loads scripts from, deploying CSP with strict allowlist, and deploying SRI hashes on all third-party scripts. The Polyfill.io attack was a supply chain attack against your visitors, not your infrastructure. You were a vector. Download the SMB Phishing Defense Pocket Guide for the SLAM framework and e-commerce-specific phishing patterns to watch for.
3. Hot Topic (2024) — 57 Million Customer Accounts, November 2024
Attacker: Not publicly confirmed; attributed to credential stuffing campaign leveraging credentials from separate, unrelated breach; data listed on BreachForums by actor "Satan" and subsequently sold; HaveIBeenPwned added Hot Topic to its database April 2025, confirming 57,064,828 accounts
Attribution: Hot Topic disclosed breach to Maine's Attorney General in late 2024; announced publicly February 2025; 57,064,828 accounts confirmed; Analysis of HaveIBeenPwned data shows email addresses, names, and partial card data potentially exposed; Hot Topic has not publicly confirmed card data compromise; Breached credentials reportedly used to attempt login on other major platforms (credential stuffing)
Dwell time: Hot Topic has not disclosed; HaveIBeenPwned breach added April 2025; breach window estimated late 2024
Dollar impact: Class action filed March 2025; cart reviewing potential damages over $350M; credit monitoring offers extended to affected customers; Hot Topic has not disclosed financial impact; Ponemon research estimates average per-record cost at $165 in retail breaches
Hot Topic's November 2024 breach — now confirmed at 57,064,828 accounts — is one of the largest retail breaches in history by record count. HaveIBeenPwned added the Hot Topic breach to its database in April 2025, confirming the scale. The attackers appear to have used credentials from a separate, unrelated breach to authenticate to Hot Topic's loyalty platform via credential stuffing.
Hot Topic's disclosure illustrated how credential stuffing can scale to tens of millions of accounts from a single successful breach: once the credential pairs are automation-tested against a retailer's loyalty platform, every successful match becomes a customer account takeover. The attackers then sold the verified credentials on BreachForums.
Root cause: No MFA on loyalty program accounts; no anomaly detection on login attempt patterns; no lockout after repeated failed login attempts; no monitoring for credential stuffing from known breached password databases.
What training would have prevented this: Customer-facing security awareness: unique password requirements for loyalty accounts, MFA enrollment prompts, and monitoring for credential stuffing against your own customer database. Learn about the SecurEveryone retail training program for building a layered defense against the credential stuffing attack pattern.
4. Neiman Marcus (2024) — 64,000 Official / 31 Million Actual, June 2024
Attacker: Oktapus group / Sp1d3r via Snowflake environment; actor "Sp1d3r" listed Neiman Marcus data for sale on BreachForums September 2024 at $15,000; attributed to same campaign as Ticketmaster/AT&T Snowflake compromise
Attribution: 64,000 Neiman Marcus customers officially notified; subsequent analysis of the Sp1d3r data listing suggests 31M unique email addresses and name/billing address records; Sn1d3r demanded $150,000 from Neiman Marcus and refused engagement; Neiman Marcus did not pay ransom; FTCfiled action against Neiman Marcus February 2025 citing inadequate security controls
Dwell time: Not publicly disclosed by Snowflake for Neiman Marcus specifically; Snowflake's confirmed exposure window April 14–May 18, 2024 covers Neiman Marcus
Dollar impact: FTCfiled action February 2025 for inadequate data security; class actionfiled November 2024; Neiman Marcus offered credit monitoring to affected customers; costs undisclosed; precedent-setting for luxury retail
Neiman Marcus disclosed a breach affecting 64,000 customers in October 2024. But the Sp1d3r data listing on BreachForums — the same actor behind the Ticketmaster/Snowflake campaign — suggests the true scope was 31 million email addresses and billing records. The discrepancy between the official notification and the actual data volume illustrates how breach disclosures systematically understate impact while investigations are underway.
The FTC's February 2025 action against Neiman Marcus was notable for luxury retail. The FTC citation of "inadequate security controls" — including failure to implement MFA as required by the FTC Safeguards Rule — established directly that the Safeguards Rule applies to specialty retail, not just financial services. Any retailer offering a store credit card or co-branded payment product is now on notice: the FTC will enforce security program requirements against you.
Root cause: No MFA on Snowflake admin accounts (same root cause as Ticketmaster); delay in breach disclosure creating larger regulatory exposure; no documented vendor security assessment of Snowflake's controls.
What training would have prevented this: Vendor security assessment: requiring MFA on all administrative accounts as a contract requirement, and annual review of vendor security posture for platforms handling customer PII. Download the Vendor Risk Assessment Toolkit for the 50-question vendor security questionnaire.
5. The North Face / VF Corp (April 2025) — Credential Stuffing, 4,851 Confirmed Accounts
Attacker: Credential stuffing campaign; attributed to use of credentials exposed in an unrelated prior breach; actor used same credentials to test logins across multiple major retail platforms
Attribution: VF Corp disclosed April 2025 that 4,851 loyalty program accounts were confirmed compromised via credential stuffing; broader campaign also affected Hot Topic and other VF Corp brands; VF Corp disclosed to Maine AG; attacker used credentials from a third-party leak to authenticate to The North Face loyalty platform
Dwell time: VF Corp discovered through internal investigation; timeline not fully disclosed; credential stuffing detected via anomaly in login patterns
Dollar impact: VF Corp offered free credit monitoring to affected accounts; costs undisclosed; brand impact from public disclosure during peak spring outdoor retail season
The North Face's parent company VF Corp disclosed in April 2025 that credential stuffing had compromised 4,851 affected accounts, a subset of a broader credential stuffing campaign that also hit Hot Topic and other retailers.
The North Face incident illustrates the compounding risk of credential reuse: the attackers used credentials from a separate, unrelated breach to successfully authenticate to The North Face's loyalty platform, where many customers had reused the same password they used elsewhere. The attackers then used those credentials to attempt login on other major platforms — a pattern known as credential stuffing.
Root cause: No MFA on loyalty program accounts; no velocity-based anomaly detection on login attempts; no block on known breached credentials.
What training would have prevented this: MFA on all customer-facing loyalty accounts; password policy enforcing unique credentials per platform; monitoring for credential stuffing patterns. Download the SMB Phishing Defense Pocket Guide for 10 attack patterns and the SLAM checklist for identifying credential-harvesting attempts.
6. Avis (2024) — 299,000 Records, August 2024
Attacker: Mobile-based social engineering and credential compromise; not ransomware; attributed to unauthorized access using credentials exposed in prior breach; similar pattern to GoldSilver buying group
Attribution: Avis disclosed August 2024 breach to New Hampshire AG; 299,000 New Hampshire residents affected; class actionFiled September 2024; Avis Budget Group 10-Q Q3 2024 disclosed $1.02M class action settlement as of Q3 2024; breach involved driver license numbers and personal data submitted during car rental
Dwell time: Avis disclosed 3-day dwell between initial unauthorized access and detection; rapid discovery compared to many enterprise breaches
Dollar impact: $1.02M class action settlement (Q3 2024); credit monitoring offered to affected customers; regulatory notification costs across all affected states
Avis Budget Group disclosed in August 2024 that an unauthorized party had accessed the personal data of approximately 299,000 individuals who had rented vehicles from the company. The breach was notable for its short dwell time — Avis detected and contained the intrusion within 3 days — and for the sensitive document types exposed: driver license numbers and other personal data submitted during the rental process.
The $1.02M class action settlementAvis reached in Q3 2024 illustrated the per-record exposure in car rental data: driver license numbers are a primary identity theft vector, making them more valuable than simple email addresses. The breach demonstrated why rental companies collecting passport and driver's license copies have particularly high data protection obligations.
Root cause: No MFA on customer-facing rental management system; no monitoring for unusual access patterns on customer PII databases; delayed detection allowed 3-day exposure.
What training would have prevented this: Security awareness training for retail and service sector employees: phishing recognition, credential management, and incident escalation procedures. See the SecurEveryone retail training program for employee security awareness training mapped to the most common attack patterns in the service sector.
7. Cisco DevHub (2024) — 4.5 TB Exposed, October 2024
Attacker: Unknown; attributed to misconfigured development environment left exposed without authentication on public internet; similar misconfiguration pattern found in Uber, Twilio, and Okta developer portals historically
Attribution: Cisco Talos disclosed October 2024 that a misconfigured DevHub environment exposed 4.5TB of data; labeled " nirvana" by attacker; included source code, private keys, hardcoded credentials, and API tokens; no customer PII confirmed; Cisco's own security researcher identified the exposure; no evidence of unauthorized access confirmed; comparable exposures at Uber (2016), Twilio (2018), and Okta (2020) developer portals
Dwell time: Unknown; Cisco Talos reported the exposure was identified internally; no public disclosure of how long it was exposed before Cisco's own team's discovery
Dollar impact: No direct financial impact confirmed; brand and security credibility damage for Cisco; comparable incidents at Uber (~$148M FTC settlement 2018), Twilio (2022 breach affecting 6.2M customers) establish precedent for regulatory and civil exposure from developer portal misconfigurations
In October 2024, Cisco's own security research team discovered that a development environment portal — Cisco DevHub — had been left publicly accessible without authentication. The exposed environment contained approximately 4.5TB of data, including source code, private encryption keys, hardcoded credentials for internal systems, and API tokens. The attacker, using the handle "Nirvana," described the data as "not some yet-to-be released project, but literally every piece of data you could imagine."
The Cisco DevHub exposure was a reminder that developer tooling is a persistent source of catastrophic supply chain risk. The same pattern — a misconfigured development portal, exposed credentials, no MFA on developer accounts — has appeared in breach after breach. Uber's 2016 breach started with an exposed private repository. Twilio's Authy breach came from a misconfigured developer portal. Okta's 2022 LAPSUS$ incident traced back to a developer's personal device compromise.
Root cause: No authentication required on public-facing DevHub environment; hardcoded credentials in source code repositories; no automated scanning for exposed developer portals; MFA not enforced on developer account access.
What training would have prevented this: Developer security training: secrets management (never commit credentials to source control), exposure monitoring, and MFA on all developer portals. Download the MFA Rollout Playbook for the 90-day MFA rollout methodology that would have prevented the developer portal exposure at Cisco.
Compliance Exposure for Retail
For retail organizations, a breach doesn't trigger a single regulatory response. It triggers a stack — and each framework has independent notification timelines, penalty exposure, and documentation requirements that require prior planning, not ad-hoc response.
PCI-DSS v4.0 (effective March 31, 2025): Every retailer that accepts card payments must comply. PCI-DSS v4.0 Requirement 12.6 mandates a documented security awareness program for all personnel who interact with the cardholder data environment. For franchise operators, this means every store employee. Requirement 6.4 requires anti-phishing mechanisms. Requirement 5.4 requires anti-phishing protections. Card brand violations can result in $5,000–$100,000 monthly penalties plus forensic investigation costs.
CCPA/CPRA: California residents have a private right of action for data breaches involving unencrypted personal information. The CPRA expanded enforcement powers of the California Privacy Protection Agency (CPPA). Hot Topic's exposure of 57M accounts in November 2024 triggered multiple class actions under CCPA. The precedent from the 2013 Target settlement ($292M multistate AG settlement) established that retailers with poor security controls face material regulatory exposure across all 50 states.
State breach notification laws: All 50 US states have independent breach notification statutes with varying timelines (30–90 days). The North Face incident, affecting customers in all 50 states, required coordinated multi-state notification response. Timelines vary: Florida's Information Protection Act (HB 121) requires 30-day notification; California requires "as expediently as possible" and no more than 3 days for certain high-risk data.
Colorado, Virginia, Texas: Colorado's Consumer Data Protection Act (CDPA, effective 2023) and Virginia's CDPA create independent notification obligations for retailers with Colorado or Virginia residents. Texas's Data Breach Notification Act (DBNA) imposes its own timeline and content requirements. Retailers operating nationally must maintain a breach notification procedure that satisfies the shortest applicable timeline — typically 30 days.
GDPR: Any retailer with EU customer data is subject to GDPR Article 33 (72-hour DPA notification) and Article 34 (notification to affected data subjects for high risk). GDPR fines can reach €20 million or 4% of global annual turnover. The 2018 Marriott/Starwood GDPR fine (£18.4M) established that hotel and retail chains are squarely in scope for EU data protection enforcement.
FTC Safeguards Rule: Retailers that offer co-branded credit cards, store-branded credit cards, or other financial products are subject to the FTC Safeguards Rule (16 CFR Part 314), which requires a written security program, annual risk assessments, documented employee training, and incident response plans. Violations carry civil penalties of up to $51,744 per violation per day. The FTC's Neiman Marcus action (February 2025) confirmed that luxury and specialty retail is squarely within scope.
Defensive Controls That Actually Work in Retail
Based on the failure points in all 7 incidents above, here are the controls with the highest return for a retail organization:
| Control | Stops | Implementation for Retail |
|---|---|---|
| MFA on all systems | Credential stuffing, account takeover | MFA on corporate VPN, M365, POS management consoles, and loyalty platforms; hardware keys or passkeys preferred over SMS for corporate accounts; phishing-resistant MFA (FIDO2/passkeys) for IT and finance staff |
| Credential stuffing detection | Automated login attacks | Velocity rules in identity platform: block after 5 failed logins in 10 minutes; geofencing on loyalty account logins; cross-reference against known breached credential databases (HaveIBeenPwned) |
| Vendor access management | Supply chain attacks, POS compromise | Quarterly review of all vendor remote access; enforce MFA for vendor support sessions; time-boxed access windows; vendor access logs reviewed monthly; immediate revocation upon vendor relationship termination |
| POS and e-commerce malware scanning | Magecart, card skimming | Daily scanning of e-commerce JavaScript dependencies for unauthorized changes; POS endpoint detection on POS management servers; network segmentation between store networks and POS transaction processing |
| Security awareness training (role-specific) | Phishing, BEC, social engineering | Finance and AP: wire fraud verification, vendor banking change callbacks; IT and helpdesk: vishing resistance, MFA reset verification; seasonal hires: phishing orientation before system access; quarterly phishing simulations with retail-specific lures |
| Zero-trust network architecture | Lateral movement, ransomware spread | Microsegmentation between store networks and headquarters; least-privilege access for store associates to corporate systems; POS terminals on isolated VLANs; corporate laptop access to store network requires MFA and device posture check |
| Third-party script monitoring (e-commerce) | Magecart, supply chain JS compromise | Deploy Content Security Policy (CSP) with strict allowlist; subresource integrity (SRI) checks on all third-party scripts; monthly audit of all JavaScript executed on checkout pages; disable or remove non-essential third-party tags via tag management system |
What to Do This Week
- Enable MFA everywhere your organization touches it this week. Every corporate account, every M365 login, every POS management console, every VPN connection. If the system doesn't support MFA today, open a ticket and track it to completion. Start with the accounts that have the broadest access: IT admin accounts, finance, HR, and executive team. The Snowflake admin account with no MFA is the single most common thread across all the major breaches in this article.
- Audit your third-party scripts on your e-commerce checkout. If you use a tag management system, go through every script that fires on your checkout page. Remove anything that isn't operationally necessary. Deploy Content Security Policy (CSP) in report-only mode this week to identify what scripts are running without your knowledge. The Polyfill.io attack and the Magecart campaigns didn't compromise your network — they compromised a script your site was already loading.
- Download the Vendor Risk Assessment Toolkit (free at /free-tools/vendor-risk-assessment-toolkit) and spend 30 minutes identifying every vendor that has access to your POS data, customer data, or network. The Snowflake breach affected 165 organizations because none of them had assessed Snowflake's security posture before trusting it with their most sensitive data. Start that assessment today.
- Run a credential stuffing simulation against your loyalty platform. You can't prevent credential stuffing if you don't know how your systems respond to it. Run a test login with a known breached credential and verify your detection controls trigger. If they don't, your systems can't distinguish between an attacker and a customer who reused a password — and that distinction is the difference between a blocked attack and 57 million exposed accounts.
- Book a training session for your retail team. The SecurEveryone retail training program covers POS malware recognition, phishing for retail corporate staff, vendor access verification, and seasonal hire security onboarding in a single 90-minute session. PCI-DSS Requirement 12.6 documentation included. Available for individual associates at $150, management teams at $390, or company-wide at $900 flat for unlimited attendees.
The retail sector's cybersecurity challenge is uniquely tied to the pace of store operations and the complexity of the vendor ecosystem that supports it. Every retailer in the cases above had a security team, compliance programs, and technical controls. What they lacked was the human-layer defense that would have caught the unusual login, the unexpected vendor behavior, or the phishing email disguised as a shift reminder. That layer isn't a technology purchase. It's trained people who know what to look for and feel empowered to escalate when something doesn't look right.
Related Resources
- Retail Cybersecurity Training Program → — POS fraud recognition, e-commerce malware awareness, vendor access verification for retail corporate and store teams
- Free Vendor Risk Assessment Toolkit → — 14-page fillable PDF: vendor inventory worksheet, Tier 1/2/3 risk tiering, 50-question security questionnaire across 10 domains including AI/LLM data handling
- Free SMB Phishing Defense Pocket Guide → — 10 attack patterns, SLAM checklist, 30-day quick-start guide for retail teams
- Free Ransomware Response Playbook → — 12-page playbook covering the ransomware kill chain, ALPHV/BlackCat analysis, and the first 72 hours of incident response
- PCI-DSS Compliance for Retail → — PCI-DSS v4.0 Requirement 12.6 security awareness training requirements, card brand fine structures, and compliance evidence documentation
- Book a Training Session → — $150 individual, $390 management team, $900 company-wide flat; PCI Req. 12.6 documentation included
The retail sector processes more personal and financial data than almost any other industry. The cases above are not isolated failures — they represent systemic exposure that improves only when retailers invest in the trained human layer that makes technical controls work. See the SecurEveryone retail program and book the training that builds those behaviors before the next breach makes the news.
Sources: DOJ Indictment, US v. Connor Thurston et al. (September 2025) · Snowflake SEC filing 8-K (June 2024) · AT&T 10-Q Q2 2024 · FBI IC3 2023 Internet Crime Report · IBM/Ponemon Cost of a Data Breach Report 2025 · Mandiant M-Trends 2024 · Sansec eGuard detection data (June 2024) · HaveIBeenPwned (Hot Topic breach data, April 2025) · CISA Advisory AA24-107A (Polyfill.io, July 2024) · Neiman Marcus SEC filing 8-K (October 2024) · FTC v. Neiman Marcus (February 2025) · The North Face / VF Corp 8-K (April 2025) · Avis Budget Group 10-Q Q3 2024 · Cisco Talos Blog: DevHub exposure (October 2024) · PCI Security Standards Council PCI-DSS v4.0 (March 2022, effective March 2025) · Target $292M multistate AG settlement (2017/2019) · CISA CIRCIA reporting guidance (2024)
Get your free pocket guide
Enter your work email and we'll send the SMB Phishing Defense Pocket Guide — 6 red flags + 5-step incident response playbook.
Check your inbox!
Your pocket guide is on its way.
No spam. Unsubscribe anytime. Unsubscribe