Ask a retail client where their cyber risk sits, and the answer usually points to IT. It is seen as a back-office problem, something for whoever looks after the servers, the passwords and the software updates.

Yet the exposure that matters most to a retail or e-commerce business sits much closer to the customer: at the till, on the checkout page and in the database holding years of names, addresses, order histories and payment details.

For brokers, that gap between perception and reality matters on two fronts. It shapes how clients present their risk to insurers, and it shapes how well they cope if the worst happens. The attacks on Marks & Spencer and the Co-op in 2025 showed how quickly a cyber incident can move from the systems team to empty shelves, suspended online orders and anxious customers.

The till is a network device

Modern point-of-sale systems are no longer standalone cash registers. They are connected terminals linked to stock control, loyalty schemes, card processors and head office reporting, often managed remotely by a third-party supplier. Every one of those connections is a route in for criminals.

Criminals understand this well. Malware designed to capture card data as it passes through a terminal's memory has been behind some of the largest retail breaches on record, and it does not need to touch the card itself. Weak remote access tools used by POS support companies, shared logins across stores and terminals running outdated software all widen the door.

Disruption risk is as significant as data risk. If ransomware locks the systems that process payments or manage stock, trading stops. A retailer can have a fully staffed shop, shelves full of products and queues of customers, and still be unable to take a single sale.

Customer data: the asset that becomes a liability

Retailers gather customer data because it is commercially valuable. Loyalty programmes, online accounts, saved payment methods and marketing preferences all help to drive repeat business. Criminals want the same information, and the more a business holds, the greater the consequences when it is exposed.

For online retailers, the checkout page is a particular weak spot. In the 2018 British Airways breach, attackers inserted a small piece of malicious code into the payment page that quietly copied customers' card details as they typed them. The Information Commissioner's Office later fined the airline £20 million. Similar "skimming" attacks target smaller e-commerce sites through compromised plug-ins and third-party scripts that the business may not even realise are running.

That third-party dimension runs right through retail. Payment gateways, e-commerce platforms, marketing tools, chat services, delivery partners and IT support providers all touch customer data or core systems. Ticketmaster UK was fined £1.25 million by the ICO after a third-party chatbot on its payment page was compromised. The 2025 M&S attack was widely reported to have begun with criminals tricking a third-party IT help desk into resetting access. The lesson for any retailer is that outsourcing a service does not outsource the responsibility for the systems or the data.

What an incident really costs a retailer

The headline fine is rarely the highest cost. Retail runs on tight margins and continuous trading, so business interruption often dominates. Every hour tills are down, or the website cannot take orders, is revenue that cannot be recovered, particularly in peak periods such as Black Friday and Christmas, when attackers know the pressure to pay a ransom is highest.

The 2025 attacks put numbers on this. M&S suspended online orders for around seven weeks and estimated a hit of around £300 million to its operating profit, which it said would be partly offset by insurance. The Co-op confirmed that personal data belonging to all 6.5 million of its members had been taken and later reported a revenue impact of around £285 million.

Around that sits a wider set of costs that retailers often underestimate. Forensic investigators need to establish what happened and what data was taken. Legal advisers manage notification to the ICO, which must normally happen within 72 hours of becoming aware of a reportable breach, and to affected customers. Card schemes and acquiring banks can impose assessments and additional requirements when a business falls short of the Payment Card Industry Data Security Standard (PCI DSS). Customers may bring claims, and rebuilding trust can mean credit monitoring offers, public relations support and marketing spend.

Then there is the long tail. Shoppers have plenty of choice, and a retailer that is seen to have lost their data may not get a second chance.

Helping retail clients close the gap

The questions that matter are commercial ones, and brokers are well placed to ask them. How long could the business trade without its tills or website? Which suppliers have remote access to payment systems? How much customer data is held, and does it all need to be kept? Who would make decisions, and who would speak to customers, if systems went down on a Saturday morning in December?

The same questions sit behind the proposal form. Cyber insurers expect evidence of specific controls before they offer terms, and retail clients who cannot demonstrate them may face higher premiums, restrictive exclusions or difficulty placing cover at all. The controls that make the biggest difference in retail are well established: patching POS and e-commerce software, separating payment systems from the rest of the network, multi-factor authentication on all remote access, monitoring the scripts running on checkout pages, tested backups, and clear security requirements for suppliers.

Not every retailer has the expertise to put those in place. Many small and mid-sized businesses rely on a stretched IT generalist or an outsourced provider focused on keeping systems running rather than secure. Specialist support can help a broker turn a difficult risk into an insurable one and help a client recover faster if an incident does occur.

How Infoprotect supports brokers and their retail clients

Infoprotect provides cyber security advice and managed services that help businesses put the right controls in place and keep them working. For brokers, that means a partner who can work alongside you with retail clients: identifying gaps before renewal, helping clients meet the security standards insurers are asking about, and providing ongoing monitoring and support so that the controls declared on a proposal form are the controls that are really in place.

Let's talk about your retail clients

If you place cyber cover for retailers or e-commerce businesses, we would welcome a conversation about how Infoprotect can support you. Whether a client is struggling to meet an insurer's security requirements, preparing for renewal or simply unsure where their exposure lies, we can help you give them practical, specialist answers.

Get in touch with Hazel Richardson on (0)7570 003027 or email Hazel.Richardson@infoprotect.co.uk