Number of cyber attacks on retailers drops by half

Despite an 50 percent decline in the number of attacks against U.S. retailers, the number of records stolen from them remains at near record highs. IBM Security researchers report that in 2014, cyber attackers still managed to steal more than 61 million records from retailers despite the decline in attacks, demonstrating cyber criminal’s increasing sophistication and efficiency.

“The threat from organized cybercrime rings remains the largest security challenge for retailers,” said Kris Lovejoy, General Manager, IBM Security Services. “It is imperative that security leaders and CISOs in particular, use their growing influence to ensure they have the right people, processes and technology in place to take on these growing threats.”

Black Friday and Cyber Monday

Cyber attackers reduced their activity across all industries on Black Friday and Cyber Monday, rather than taking action. When looking at the two week period (Nov 24 – Dec 5) around these days the data shows the following activity across all industries:

• The number of daily cyber attacks was 3,043, nearly one third less than the 4,200 average over this period in 2013.
• From 2013 and 2014, the number of breaches dropped by more than 50 percent for Black Friday and Cyber Monday.
• In 2013, there were more than 20 breaches disclosed including several large breaches that caused the number of records compromised to rise drastically, reaching close to 4 million.
• Over the same period in 2014, 10 breaches were disclosed which resulted in just over 72,000 records getting compromised.

Despite this cyber threat slow down, the retail and wholesale industries did emerge as the top industry target for attackers in 2014, a potential result of the wave of recent high profile incidents impacting name brand retailers. In the two years prior, manufacturing ranked first amongst the top five attacked industries while retail and wholesale industry ranked last.

This past year, the primary mode of attack was unauthorized access and more specifically Secure Shell Brute Force attacks, which surpassed malicious code, the top choice in 2012 and 2013.

Top breaches overshadow growing trend

Attackers secured more than 61 million records in 2014, down from almost 73 million in 2013. However, when the data was narrowed down to only on incidents involving less than 10 million records (which excludes the top two attacks over this timeframe, Target Corporation and The Home Depot), the data shows a different story: the number of retail records compromised in 2014 increased by more than 43 percent over 2013.

Sophisticated methods of attack

While there has been a rise in the number of Point of Sale (POS) malware attacks, the vast majority of incidents targeting the retail sector involved Command Injection or SQL injection.

The complexity of SQL deployments and the lack of data validation performed by security administrators made retail databases a primary target. Over 2014, this Command Injection method was used in nearly 6,000 attacks against retailers. Additional methods include Shellshock as well as POS malware such as BlackPOS, Dexter, vSkimmer, Alina and Citadel.