UK convenience retailers have been urged to strengthen their cybersecurity following attacks affecting retailers in France and the UK, with experts warning that weak security could disrupt store operations, expose customer data and cause financial losses.
Ben Large, head of cyber security at technology solutions firm Cybit, warned that independent stores were just as vulnerable to attacks as major supermarket chains.
“It is a common misconception that smaller stores are less at risk,” he told Asian Trader. “Automated hacking bots are looking for vulnerabilities, so don’t care about the scale of their would-be victims.”
His warning follows a cyberattack on French supermarkets on Monday (12 October) in which hackers remotely manipulated refrigeration systems, raising temperatures and putting food stocks at risk.
In the UK, TFG London, owner of Hobbs, Whistles and Phase Eight, on Sunday reported a cyberattack affecting some of its IT systems. ASOS has also recently disclosed unauthorised access to customer information, while H&M has been investigating claims of a cyberattack.
Connected devices pose a risk
Cyberattacks could affect more than customer data. Payment terminals, electronic point of sale (EPOS) systems and stock management could be disrupted, while criminals could gain access to business bank accounts, trigger unnecessary stock orders or misuse a store’s network to attack other organisations.
Large said internet-connected devices could be prone to attack if their security was not well maintained.
“A few simple preventative measures can reduce that risk dramatically,” he said, advising retailers to change default access details before deploying devices and keep them updated.
Large recommended restricting connected devices to their intended functions, avoiding unnecessary software installations and internet browsing on business devices, and applying security patches promptly.
Susannah Streeter, chief investment strategist at Wealth Club, warned that businesses needed to treat cybersecurity as a priority rather than an optional expense.
“Cyber security can no longer be treated as a back-office IT issue or a cost to be trimmed when budgets come under pressure,” she said.
“Retailers are particularly attractive targets, sitting on valuable customer data and relying on interconnected systems to keep everything from online orders to supply chains moving. The consequences of a breach can stretch far beyond stolen information, hitting sales, disrupting operations and eroding customer trust.”
Last year, Marks & Spencer and Co-op was badly hit by cyber attacks, with Co-op reporting a £206m revenue hit in the first half of 2025 and M&S a £209.7 million profit decline in 2025-26 as a result of the disruptions.
Large asked retailers to "push hard" on third-party suppliers providing payment systems, EPOS software and cloud services to ensure that their "products are tested and ensure patches for custom software are provided in a timely manner."
While multi-factor authentication, passkeys and network monitoring can improve protection, they cannot eliminate every vulnerability, he added.
“It only takes one gap in the armour to become vulnerable,” Large said, highlighting outdated software, poorly coded websites and staff who are not trained to recognise social engineering attacks as potential weaknesses.
Affordable protection
Large recommends the government’s Cyber Essentials programme as a starting point for protection against common cyber threats.
He also highlighted endpoint detection and response (EDR) systems, which monitor device activity for suspicious behaviour and can be managed by an external provider. A managed service provider can audit a retailer’s devices, systems and networks, identify weaknesses and help prioritise improvements without the need for an in-house IT team.
"If you don't protect the business and it suffers an attack then the impacts will almost certainly be much greater then the cost of up-front protection," he added.