Cyberpion released research today showing that most (83%) of the top U.S. retailers have connections to a vulnerable third-party asset, and nearly half of them (43%) have vulnerabilities that pose an immediate cybersecurity risk. In addition, the company found that nearly one-third (30%) of these retailers have an asset that either was, or is currently being abused, in an active hacking campaign, and nearly a quarter (23%) have a compromised asset that is under the control of hackers. 

The findings were generated with Cyberpion, who performed a single-pass, external scan of the online ecosystems of the top 30 U.S. retailers based on 2020 sales according to the National Retail Federation, including Walmart, Amazon, Kroger, and Costco. The scan exposed thousands of total online connections (29,998), domains and sub-domains (2,054), cloud instances - virtual server instances from cloud networks - (1,203), and connected third party resources (1,131) within these retailers’ online ecosystems. 

“This holiday season is a perfect storm for the retail industry given increased e-commerce activity due to Covid-19, and the heavy reliance of retailers on third party providers of tracking, behavior, analytics and advertising services,” said Cyberpion CRO Ran Nahmias. “These services often represent thousands of points of vulnerability, greatly enlarging retailers’ attack surfaces for hackers to capitalize on. The problem is that retailers aren’t aware that some of the biggest threats to their customers and businesses exist outside the traditional perimeter.  Solutions like firewalls and antivirus software don’t detect these types of vulnerabilities.”

This holiday season could be an especially busy one for retail consumers and hackers alike. Online purchases spiked by approximately 30% according to the US Census Bureau in the first half of 2020, and will likely continue to grow, particularly towards the end of the year. The retail industry has collectively boosted their digital transformation initiatives to improve customers’ online experiences while simultaneously looking to achieve greater cyber security with 57% of retailers reporting in BDO’s 2020 report on Retail Digital Transformation that improving cybersecurity is a top priority.