When a retailer is hit, the incident response plan has to keep tills, distribution and online orders running while the security team works out who is inside the network. The 2025 attacks on UK retailers showed what that looks like in practice: an entry through help desk impersonation, a decision to switch off systems, paused online orders and empty shelves, followed weeks later by confirmation that customer data had gone. This guide is for retail security leads, IT operations, store operations and the crisis team. It covers how a retail incident differs from the general case, the first decisions, containment that protects trading, card and loyalty fraud response, notifications, and how to rehearse before peak trading. It builds on the general Incident Response Guide; for the preventive programme see the Cybersecurity for Retail and Ecommerce Guide.
Key takeaways
- Trading continuity is a security decision. Decide in advance which systems you can switch off, for how long, and what stores and fulfilment do while they are off.
- Lock down the help desk first. Retail intrusions in 2025 began with password and MFA resets for impersonated staff and contractors, so pausing remote resets is an early containment step.
- Card data has its own clock. Visa's supplemental requirements set 3 calendar day reporting steps and a 5 business day window to contract a PCI Forensic Investigator when one is required.
- Loyalty accounts are money. Freeze redemptions and transfers early during credential stuffing or a data breach, because points convert to goods within minutes.
- Rehearse before peak. Run the tabletop with trading, logistics, stores and communications before the main trading season, not during it.
How a retail incident differs from the general case
Retail estates combine a corporate network, hundreds of stores with tills and handheld devices, distribution centres, ecommerce platforms, outsourced help desks and many third parties with remote access. Margins are thin and stock moves daily, so an outage costs revenue immediately. M&S estimated a reduction in profit of about £300 million before recoveries after its 2025 incident, as described on the Marks and Spencer Cyberattack 2025 page.
| Factor | General enterprise | Retail |
|---|---|---|
| Cost of downtime | Productivity loss | Lost sales per hour, perishable stock, empty shelves |
| Endpoints | Laptops and servers | Tills, payment terminals, store servers, handhelds, kiosks |
| Staff identity | Mostly named office users | Large seasonal and frontline workforce, shared store devices, contractors |
| Customer exposure | Limited | Card data, loyalty accounts, order histories |
| External rules | Data protection | Data protection plus card scheme rules and acquirer contracts |
| Timing | Any time | Attackers and fraudsters favour peak periods and bank holidays |
The first hours: decisions for the crisis team
M&S detected its intrusion two days after entry and convened a crisis team; Co-op disclosed unauthorised access attempts, took some systems offline and told staff to stop using VPNs the next day, as described on the Co-op Cyber Attack 2025 page. The crisis team should work through these questions in the first hours.
- What do we know? Entry route if known (help desk reset, supplier access, phishing, exploited system), which identities are involved, and whether there is evidence of Active Directory or identity provider compromise.
- Is card data in scope? Any sign of access to payment systems, the ecommerce checkout or store payment servers starts the card scheme clock.
- What can we keep running safely? Online orders, click and collect, store tills, replenishment and distribution each need a go or no-go decision.
- Who decides? A named executive owns trading decisions; the incident lead owns technical containment. Write both down.
- Who must we tell, and by when? Start the notification log now (see below).
Containment that protects trading
NHI Mgmt Group suggests preparing each containment action with its trading impact written beside it, so the decision can be taken in minutes. The table is our suggested starting set.
| Action | When to use it | Trading impact | Degraded mode to prepare |
|---|---|---|---|
| Suspend remote password and MFA resets | Any sign of help desk impersonation | Staff locked out wait longer | In-person reset at store or office with photo ID and manager approval |
| Disable VPN and remote access | Attacker using remote access or stolen sessions | Head office and suppliers lose access | Allow-listed break-glass access for the response team only |
| Suspend supplier and MSP accounts | Third-party vector suspected | Outsourced services pause | Named supplier contacts on a separate channel |
| Isolate the corporate network from stores | Lateral movement risk | Stores lose price updates and stock data | Offline till operation and manual price lists |
| Pause online and app orders | Ecommerce or order systems at risk | Online revenue stops | Static "orders paused" page and customer service script |
| Disconnect compromised payment systems | Suspected card data compromise | Affected lanes or channels stop taking cards | Alternative terminals, only within acquirer and scheme rules |
Card systems: Visa's What To Do If Compromised (version 10.0, effective 25 June 2026) says to disconnect compromised systems from the internet and stop using them for payments, isolate them from the network, and preserve logs and images, but not to log in with administrative credentials, change passwords on, turn off or reboot the compromised systems. Brief store and IT staff on this before an incident, because their instinct will be to reboot.
Store-and-forward: offline card authorisation carries fraud and liability risk; agree the rules, limits and duration with your acquirer in advance rather than during the incident.
Where identity fits
The NCSC's 4 May 2025 recommendations after the retail incidents focused on identity: MFA across the organisation, monitoring for account misuse and risky sign-ins, close attention to Domain Admin, Enterprise Admin and Cloud Admin accounts, reviewing how the help desk verifies staff before resets, and detecting sign-ins from unusual sources such as VPN services in residential IP ranges. In incident terms that means:
- Privileged accounts: confirm every Domain, Enterprise and Cloud Admin session is legitimate; remove any added in the incident window (ATT&CK T1098 Account Manipulation).
- Directory compromise: if the attacker reached the Active Directory database (T1003.003 NTDS), which reporting says was targeted at Co-op, plan a full credential reset including krbtgt (reset twice) and every service account. See the Active Directory Domain Compromise Playbook.
- Machine credentials: rotate API keys and service accounts used by ecommerce platforms, payment integrations, store systems and supplier connections, not only human passwords.
- Help desk: follow the Help Desk Social Engineering Incident Playbook to find every reset in the window and re-verify the people behind them.
Card data compromise: the scheme timeline
Card scheme requirements run alongside data protection law. Visa's supplemental requirements set the following steps for merchants; other schemes and your acquirer contract have their own, so confirm them in advance.
| Step | Timeframe (Visa, version 10.0) |
|---|---|
| Notify your acquiring bank | Immediately |
| Report to Visa Global Risk Investigations | Within 3 calendar days of evidence that raises reasonable suspicion or confirms a compromise |
| Incident report to Visa and the acquirer | Within 3 calendar days of notifying Visa |
| Upload at-risk account numbers | Within 3 calendar days of discovery, Visa's request or the window of exposure being set |
| Contract a PCI Forensic Investigator (if required) | Within 5 business days; preliminary report within 5 business days of contract |
| Final forensic report | Within 10 business days of the investigation's completion |
The PFI must not have provided services such as QSA work to you within the past three years, so check that your retained incident response firm can act as PFI for you before you need it. For checkout script compromise specifically, use the Web Skimming Incident Playbook.
Loyalty account and customer fraud response
Loyalty schemes, gift cards and saved payment methods are attacked during and after a retail incident in two ways: credential stuffing against customer accounts (T1110.004), and phishing that uses stolen customer data to look convincing. The response differs from the corporate intrusion and needs its own owner, usually fraud or digital.
- Freeze value movement: temporarily block points transfers, redemption to new delivery addresses and gift card conversion while you assess.
- Force step-up: require re-authentication or a one-time code for redemptions and address changes, and reset passwords for accounts seen in stuffing attempts.
- Reverse and restore: restore points to affected members and record each case for fraud loss reporting.
- Warn customers: tell members what you will never ask for (passwords, full card numbers, one-time codes) when you confirm a data breach, since stolen contact details fuel phishing.
See the Credential Stuffing Attack Response Playbook and the Loyalty Points and Gift Card Fraud Guide.
Notifications and communications
| Audience | Trigger | Timing and route |
|---|---|---|
| ICO (UK) | Personal data breach unless unlikely to result in a risk to individuals | Without undue delay and, where feasible, within 72 hours of becoming aware (UK GDPR Article 33); record every breach |
| Affected customers | High risk to individuals | Without undue delay; see the Customer Breach Notification Letter Template |
| Acquirer and card schemes | Suspected card data compromise | See the scheme timeline above |
| Police (UK) | Cyber crime | Report Fraud (which replaced Action Fraud on 4 December 2025), at reportfraud.police.uk or 0300 123 2040; in Scotland, Police Scotland on 101 |
| NCSC | Significant incident | Report an incident service |
| Market (listed companies) | Inside information | Regulatory announcement, as M&S did on 22 April 2025 |
| Store staff and suppliers | Any operational change | Out-of-band channel; assume corporate email and chat may be monitored |
Outside the UK, use the Breach Notification Laws by Country Guide. Keep customer messages factual and update them as facts change: Co-op first said a limited amount of member data was accessed and later confirmed that data of all 6.5 million members was taken.
Recovery and preparing for peak
- Restore in revenue order: agree the order in advance, typically identity services, payments, store tills, replenishment and distribution, then online ordering and loyalty.
- Rebuild identity before reconnecting: clean directory, new privileged credentials and rotated machine credentials before stores and suppliers reconnect.
- Reopen online in stages: M&S restarted online ordering in June after pausing on 25 April, with disruption into July; staged reopening by region or category limits the blast radius if something was missed.
- Exercise before peak: NHI Mgmt Group suggests a ransomware tabletop at least once a year, scheduled before the main trading season, including store operations, logistics, customer service and the outsourced help desk.
- Freeze changes at peak, not security: a peak change freeze should still allow emergency patching and credential rotation.
See the Cyber Resilience Guide for backup and recovery design.
Detection and measurement
- Reset anomalies: password or MFA resets followed within an hour by a new device sign-in and privileged activity.
- Unusual sign-in sources: admin or supplier sign-ins from residential proxy or VPN ranges, as the NCSC recommends.
- Loyalty signals: spikes in failed logins, redemptions to new addresses and points transfers.
- Metrics: time from detection to crisis team convened; time to suspend remote resets; share of stores able to trade offline in the last test; days from suspicion to acquirer notification; percentage of machine credentials rotated after an incident; date of last peak tabletop.
Framework mapping
| Activity | NIST CSF 2.0 | NIST SP 800-53 Rev 5 | ATT&CK |
|---|---|---|---|
| Plan, roles and trading decisions | GV.OC-04, RS.MA-01 | IR-8, CP-2 | |
| Containment and eradication | RS.MI-01, RS.MI-02 | IR-4 | T1078, T1133, T1199 |
| Help desk and identity recovery | RS.AN-03 | AC-2, IA-5 | T1566.004, T1098, T1003.003 |
| Customer account fraud | DE.AE-02 | SI-4 | T1110.004, T1657 |
| Notification and communication | RS.CO-02, RC.CO-03 | IR-6 | |
| Recovery | RC.RP-01 | CP-10 | T1486 |
NIST SP 800-61 Rev. 3 (April 2025) frames incident response as a CSF 2.0 community profile; see the NIST SP 800-61 Incident Response Guide.
Common failure patterns
- No pre-agreed switch-off list: systems shut down ad hoc, so stores and fulfilment stop for longer than needed.
- Help desk left open: remote resets continue during the incident, giving the attacker a way back in.
- Rebooting card systems: evidence destroyed, which complicates the forensic investigation and scheme reporting.
- Human passwords only: service accounts, integration keys and supplier credentials left unrotated after a directory compromise.
- Loyalty treated as out of scope: points drained while the team focuses on the corporate network.
- Early reassurance: customer statements that later have to be corrected.
Practitioner checklist
- Write a switch-off list with the trading impact and degraded mode for each action.
- Name the executive who owns trading decisions during an incident.
- Prepare an in-person reset procedure to replace remote resets at short notice.
- Agree offline and store-and-forward rules with your acquirer before you need them.
- Confirm a PCI Forensic Investigator you can contract within five business days.
- Give fraud a loyalty freeze runbook and authority to use it.
- Pre-draft customer, staff and market statements.
- Run a peak-season tabletop including stores, logistics and the outsourced help desk.
Standards and references
- NCSC: Incidents impacting retailers, recommendations from the NCSC
- NCSC: Incident management
- NIST: SP 800-61 Rev. 3 Incident Response Recommendations
- Visa: What To Do If Compromised
- legislation.gov.uk: UK GDPR Article 33
- ICO: Report a personal data breach
Related NHI Mgmt Group resources: Retail and E-Commerce Identity Security Guide · Top 10 Ecommerce Security Threats · Financial Services Incident Response Guide · Incident Response Guide