Retailers are asked to justify security budgets with numbers, but most retail cyber statistics in circulation cannot be traced to the report they came from. This page collects current retail and ecommerce figures from primary publishers only: the Verizon 2026 Data Breach Investigations Report (DBIR) retail snapshot, the Sophos State of Ransomware in Retail 2025, the 2025 Imperva Bad Bot Report, the UK Finance Annual Fraud Report 2025 and the Marks and Spencer full-year results statement of May 2025. Each figure carries its publisher, report and data period in the same sentence or table row, and single vendor surveys are labelled as such. It is written for retail CISOs, ecommerce and fraud leaders, risk teams and boards who need defensible numbers. For the controls behind these numbers, read the Cybersecurity for Retail and Ecommerce Guide. Last reviewed: November 2026.
Source note: every figure is quoted from the named publisher's report, advisory or filing listed at the end; survey and vendor telemetry figures are single-source and labelled with their publisher. Confirm against the official text before relying on it.
Key takeaways
- Retail breaches are frequent and almost entirely external. The Verizon 2026 DBIR counts 997 retail incidents and 806 confirmed breaches, with external actors in 99% of breaches and a financial motive in 85%.
- Vulnerability exploitation is the main way in. The same DBIR snapshot puts exploitation of vulnerabilities behind 42% of retail breaches, ahead of credential abuse (14%) and phishing (9%).
- Suppliers are involved in most retail breaches. Verizon records third-party involvement in 68% of retail breaches in the 2026 DBIR.
- Retailers that are hit pay more often. Sophos's 2025 survey finds 58% of retailers hit by ransomware paid to recover data, above the 49% cross-sector average it reports, with a median payment of $1 million.
- Bots and card-not-present fraud are the ecommerce tax. Imperva reports bad bots made up 59% of retail traffic in 2024, and UK Finance reports nearly 2.6 million remote purchase fraud cases in the UK in 2024.
Headline statistics
| Statistic | Figure | Source and data period |
|---|---|---|
| Retail incidents analysed | 997 incidents, 806 confirmed data disclosures | Verizon 2026 DBIR, retail (NAICS 44-45), October 2024 to November 2025 |
| Top breach patterns | System Intrusion, Basic Web Application Attacks and Social Engineering: 95% of retail breaches combined | Verizon 2026 DBIR |
| Initial access: exploited vulnerabilities | 42% of retail breaches | Verizon 2026 DBIR |
| Third-party involvement | 68% of retail breaches | Verizon 2026 DBIR |
| Human element | 58% of retail breaches | Verizon 2026 DBIR |
| Ransomware attacks with data encrypted | 48% (down from 71% in 2023) | Sophos State of Ransomware in Retail 2025, vendor survey, January to March 2025 |
| Retailers that paid a ransom | 58% | Sophos State of Ransomware in Retail 2025 |
| Bad bot share of retail web traffic | 59% | 2025 Imperva Bad Bot Report, calendar year 2024 |
| UK remote purchase fraud cases | Nearly 2.6 million (up 22%) | UK Finance Annual Fraud Report 2025, calendar year 2024 |
| Estimated profit impact of one retail cyber incident | Around £300m on group operating profit before mitigation | Marks and Spencer full-year results statement, May 2025, for 2025/26 |
Statistics by theme
Breaches: who attacks retailers and how
The Verizon 2026 DBIR retail snapshot covers incidents from October 2024 to November 2025. Its figures for confirmed retail breaches:
| Measure | Retail figure (share of breaches) |
|---|---|
| Threat actors | External 99%, internal 1% |
| Actor motives | Financial 85%, espionage 19% |
| Initial access vectors | Exploitation of vulnerabilities 42%, credential abuse 14%, phishing 9% |
| Data compromised | Internal 84%, credentials 26%, secrets 20%, other 14% |
| Third-party involvement | 68% |
| Human element | 58% |
Two figures stand out for identity teams. Credentials were compromised in 26% of retail breaches and secrets in 20%, which means API keys, tokens and other machine credentials leave the business in roughly one breach in five. And espionage appears as a motive in 19% of retail breaches, a reminder that retailers hold supplier, pricing and customer data of interest beyond quick financial gain. Across all industries, the same DBIR reports ransomware in 48% of breaches.
What this means: patching internet-facing systems and governing supplier access are the two largest levers. The Retail and E-Commerce Identity Security Guide covers supplier and store identities in depth.
Ransomware: encryption, payments and recovery
The Sophos State of Ransomware in Retail 2025 is a single vendor survey: Vanson Bourne interviewed IT and security leaders between January and March 2025, and the retail findings come from 361 retail organisations, with 100 to 5,000 employees, hit by ransomware in the previous year, out of 3,400 respondents across 17 countries. Its figures:
| Measure | Retail 2025 | Comparison given by Sophos |
|---|---|---|
| Attacks where data was encrypted | 48% | 71% peak in 2023 |
| Paid to recover data | 58% | 32% in 2021; 49% cross-sector average |
| Median ransom demand | $2 million | $1 million in 2024 |
| Median ransom payment | $1 million | $950,000 in 2024 |
| Mean recovery cost, excluding ransom | $1.65 million | Lowest in three years |
| Most common technical root cause | Exploited vulnerabilities, 30% | Not applicable |
| Lack of expertise as a factor | 45% | Highest of any sector surveyed |
| Unknown security gaps as a factor | 46% | Not applicable |
The survey and the DBIR agree on one point from different methods: exploited vulnerabilities lead both the DBIR initial access figures (42%) and the Sophos root causes (30%). The rising payment rate alongside falling encryption suggests attackers are relying more on data theft and pressure than on locking systems. Use the Retail Incident Response Guide for the response side.
Bots and automated attacks
The 2025 Imperva Bad Bot Report, based on Imperva's network traffic in calendar year 2024, reports:
- Automated share of all web traffic: 51%, which the report describes as the first time in a decade automated traffic exceeded human traffic.
- Malicious bots across the internet: 37% of traffic, up from 32% in 2023.
- Retail: the press release states that travel and retail "face an advanced bot problem", with bad bots making up 41% and 59% of their traffic respectively.
- APIs: 44% of advanced bot traffic targeted APIs.
For retail this traffic is scalping, scraping, gift card checking, credential stuffing and fake account creation. A retailer that measures conversion rates or capacity against total traffic is measuring bots. See the Bot Traffic and Automated Attack Statistics Guide for cross-sector figures.
Card-not-present and ecommerce fraud
The UK Finance Annual Fraud Report 2025 covers fraud reported by UK banks and card issuers in calendar year 2024:
| Measure (UK, 2024) | Figure |
|---|---|
| Total stolen through authorised and unauthorised fraud | £1.17 billion, roughly flat on 2023 |
| Unauthorised fraud losses | £722 million (up 2%), 3.13 million cases (up 14%) |
| Unauthorised fraud prevented by banks | £1.45 billion, 67p of every £1 attempted |
| Remote purchase (card-not-present) fraud cases | Nearly 2.6 million (up 22%) |
| Remote purchase fraud losses | Just under £400 million (up 11%) |
| Card ID theft losses | £58.7 million (down 26%) |
Remote purchase fraud is the fraud category that ecommerce merchants feel directly, through chargebacks and the stolen card data that web skimming produces. Its case count grew faster than its losses in 2024, which points to more, smaller fraudulent transactions. The PCI DSS for E-commerce Payment Page Scripts Guide and the Web Skimming Incident Playbook cover the payment page controls.
Downtime and business cost
Industry surveys give averages; company disclosures give real figures. In its full-year results for the 52 weeks to 29 March 2025, Marks and Spencer stated that its "current estimate before mitigation is an impact on Group operating profit of around £300m for 2025/26", to be reduced "through management of costs, insurance and other trading actions", and that online sales and trading profit had been "heavily impacted by the necessary decision to pause online shopping", with disruption expected to continue "throughout June and into July". The incident is analysed in the Marks and Spencer Cyberattack 2025 breach page; a parallel attack at the same time is covered in the Co-op Cyber Attack 2025 page. Both began with social engineering of help desk or third-party access, which matches the DBIR's 68% third-party involvement figure.
What the numbers mean for defenders
| Finding | Control priority | Measure to track |
|---|---|---|
| Exploited vulnerabilities lead initial access (DBIR 42%, Sophos 30%) | Patch internet-facing systems and ecommerce platforms against the CISA Known Exploited Vulnerabilities catalogue first | Days to remediate KEV-listed vulnerabilities on external assets |
| Third-party involvement in 68% of breaches | Supplier and contractor access review, strong help desk verification | Share of third-party accounts with MFA and an expiry date |
| Credentials (26%) and secrets (20%) compromised | Secrets scanning, short-lived tokens, MFA on admin and data platforms | Long-lived secrets older than 90 days |
| 59% bad bot share of retail traffic | Bot management at login, checkout, gift card and API endpoints | Credential stuffing attempts blocked; fake account rate |
| Card-not-present fraud cases up 22% in the UK | Payment page script control, 3-D Secure, fraud scoring | Chargeback rate; unauthorised script changes detected |
| 58% of hit retailers paid a ransom | Tested offline backups and a degraded trading mode | Time to restore top revenue systems in tests |
Where identity fits: credential abuse, help desk social engineering and stolen secrets appear in every source above. Inventorying and governing machine credentials (API keys for payment, marketplace and logistics integrations) is part of retail security, not an extra. See the Non-Human Identity and Secrets Statistics Guide.
Using these figures in a retail business case
Sector statistics are inputs to a risk discussion, not a forecast for one business. A board paper is stronger when each figure is tied to a control decision and to the retailer's own data.
- Start with the attack route, not the headline: the DBIR shows exploited vulnerabilities (42%) and third parties (68%) dominating retail breaches. Compare those with your own incident and near-miss records for the last 12 months, and say where your experience differs.
- Use company disclosures for impact: a single figure such as the Marks and Spencer estimate of around £300m on operating profit shows the scale an online trading pause can reach. Scale it to your own online revenue per week rather than quoting it as a likely loss.
- Label surveys as surveys: the Sophos median payment of $1 million and recovery cost of $1.65 million come from organisations that were hit and chose to respond. Present them as "among retailers hit by ransomware", never as an expected cost.
- Tie bot and fraud figures to owned metrics: Imperva's 59% bad bot share and the UK Finance remote purchase fraud figures matter only when set beside your own login failure rates, fake account creation, gift card balance checks and chargeback ratio.
- Show the trend you will report: pick three of the measures in the defenders table and commit to reporting them quarterly, so the next budget request is backed by your own numbers.
Smaller retailers and marketplace sellers can usually skip the survey figures and focus on two numbers they control: time to patch the ecommerce platform and its plugins, and the share of admin and supplier accounts with MFA. Larger groups with stores, distribution centres and franchise partners should split every measure by channel, because store systems, ecommerce and logistics have different attack routes and different owners.
Common failure patterns when using retail statistics
- Mixing populations: the DBIR counts confirmed breaches in its dataset; Sophos surveys organisations already hit by ransomware. A Sophos percentage is not a probability of being attacked.
- Dropping the period: the 2026 DBIR covers incidents from late 2024 to late 2025; the Imperva and UK Finance figures cover calendar 2024. Quote the period with the figure.
- Treating a single disclosure as a benchmark: the Marks and Spencer £300m figure is one company's estimate before mitigation, not an industry average.
- Quoting aggregator pages: statistics roundup sites often round, merge or misdate figures. Go to the publisher's report.
- Confusing traffic share with attack share: Imperva's 59% is bad bot share of retail traffic, not retail's share of all bot attacks.
- Applying UK figures globally: UK Finance data covers UK-issued cards and UK banks only.
Methodology notes and caveats
- Verizon DBIR: built from incidents contributed by Verizon and partner organisations; percentages are of the retail breaches in that dataset. Breaches can have several actors, motives and data types, so columns can exceed 100%.
- Sophos: a vendor-commissioned survey of self-reported experience; retail findings come from 361 respondents and may not represent the largest or smallest retailers.
- Imperva: measured on traffic crossing Imperva's own network, which reflects its customer base.
- UK Finance: reported by member banks and card issuers; it does not capture fraud absorbed by merchants without a bank report.
- Refresh: all four recurring sources publish annually; update this page when each new edition appears and restate any changed figure.
Framework mapping
| Framework | Reference | Use with these statistics |
|---|---|---|
| NIST CSF 2.0 | ID.RA-03 threats identified; GV.OV-03 performance evaluated | Use sector figures as threat inputs and track the measures in the table above |
| PCI DSS v4.0.1 | Requirements 6.4.3 and 11.6.1 for payment page scripts | Card-not-present fraud and web skimming |
| MITRE ATT&CK | T1190 Exploit Public-Facing Application; T1078 Valid Accounts | The leading initial access routes in the DBIR snapshot |
Practitioner checklist
- Quote every figure with publisher, report, edition and data period.
- Use DBIR retail figures for attack patterns and Sophos for ransomware outcomes, and say which is a survey.
- Put KEV-listed external vulnerabilities at the top of the remediation queue.
- Report third-party account coverage and help desk verification to the board.
- Measure bot traffic separately before using traffic figures for capacity or conversion.
- Track card-not-present fraud and chargebacks alongside payment page script changes.
- Test restoration of top revenue systems and a degraded trading mode at least yearly.
- Refresh this set of figures when each annual report is published.
Standards and references
- Verizon: 2026 Data Breach Investigations Report executive summary
- Sophos: The State of Ransomware in Retail 2025
- Imperva (Thales): 2025 Imperva Bad Bot Report press release
- UK Finance: Annual Fraud Report 2025 press release
- Marks and Spencer: Full year results, 52 weeks ended 29 March 2025
- CISA: Known Exploited Vulnerabilities Catalog
- NIST: Cybersecurity Framework 2.0
Related NHI Mgmt Group resources: Cybersecurity for Retail and Ecommerce Guide · Retail and E-Commerce Identity Security Guide · Retail Incident Response Guide · Top 10 Ecommerce Security Threats