In this article we hear from by Moore Kingston Smith: Anna Matveeva, Partner and Head of Retail & Wholesale, and Maritz Cloete, Director of Risk Advisory.
At the recent 2026 FT Future of Retail Summit, one topic featured far more prominently than it did the previous year: cyber security.
The timing could hardly have been more relevant. During the summit, news emerged of a cyber incident affecting ASOS, reinforcing a theme that had already featured throughout the agenda and panel discussions.
Cyber attacks are no longer unusual events affecting only the largest organisations. They have become an operational risk across the retail sector.
Cyber resilience moves up the retail agenda
In 2025, cyber attacks on major retailers such as M&S and Co-op dominated headlines and prompted industry-wide debate. Since then, further incidents across the UK, Europe and the US have shown how persistent and widespread the threat has become.
For retail boards and leadership teams, the challenge is becoming more pressing. Retailers are increasingly dependent on digital platforms, interconnected supply chains, online sales channels and artificial intelligence-enabled technologies.
Resilience planning therefore needs to consider not only prevention, but also how the business would respond and recover from an incident.
Moving beyond prevention
Investment in cyber security remains essential, but many organisations recognise that prevention alone is not enough.
A resilient approach needs to include containment, recovery and operational continuity. Retail leadership teams should therefore ask practical questions such as:
- how quickly could we identify an attack;
- who would make key decisions during an incident;
- how would stores, websites and fulfilment operations continue to function;
- what would we communicate to customers, suppliers and the media; and
- how long would recovery actually take?
For many organisations, a cyber response plan already exists. The challenge is that plans can appear robust on paper but prove ineffective during a live incident if they have never been tested.
A compromised employee account may require a very different response from a ransomware attack affecting a core retail platform or causing a complete network outage. Effective response plans need to reflect these different scenarios and clearly define the roles and responsibilities of relevant teams.
Cyber security is not just an IT issue
The consequences of a cyber incident extend well beyond technology.
Retailers must also consider:
- customer and brand communications;
- UK GDPR and data breach reporting obligations;
- wider regulatory requirements;
- third-party and supply chain dependencies;
- operational disruption and business continuity; and
- financial and reputational damage.
National Cyber Security Centre guidance emphasises the importance of planning and testing incident responses, with people, processes and technology working together.
Effective cyber resilience therefore needs to extend beyond the IT function and form part of wider business planning. This includes involving senior leadership, operational teams, legal and compliance specialists, communications teams and relevant external advisers.
Resilience as a commercial advantage
How a retailer prepares for and handles an incident can be as important as the measures taken to prevent one.
Clear, timely communication can help protect customer trust, while a well-rehearsed response can limit the impact on trading, reputation and supplier relationships.
With peak trading approaching, retailers should ensure that response plans have been tested, insurance terms are understood and key supplier dependencies have been considered. Demonstrating this level of preparedness can strengthen confidence among customers, partners and investors.
Taking a proactive approach to cyber resilience
Strong technical controls remain important, but effective cyber resilience also depends on proactive planning, testing and regular review of response arrangements.
Boards and leadership teams should consider testing their plans against a range of realistic scenarios. These might include a compromised employee account, disruption to a critical supplier, the loss of an e-commerce platform or a ransomware attack affecting the wider network.
Tabletop exercises and simulations can help identify unclear responsibilities, overlooked dependencies and gaps between documented plans and operational reality. They can also give decision-makers the opportunity to practise working under pressure before a real incident occurs.
Retailers should understand their cyber insurance arrangements, including notification requirements, exclusions and the support available following an incident. Critical third-party relationships should also form part of this assessment, particularly where a single technology, logistics or payment provider supports several areas of the business.
The objective is not to predict every possible event. It is to ensure that the organisation can make informed decisions, communicate clearly and maintain essential operations when established processes are under pressure.
As reliance on digital infrastructure and interconnected supply chains continues to grow, cyber resilience should be treated as a business-wide priority. Retailers that prepare, test and learn before an incident will be better placed to protect customer trust, maintain essential services and restore operations following disruption.
*the views expressed are the author's and not ICAEW's