Hardlines Strategies

OPERATIONS

of facing at least one BEC attack per week, says Luke Vander Linden, Retail & Hospitality ISAC vice president of membership and marketing. Retailers are particularly vulnerable. In 2023, they were the second highest targeted industry for vendor email compromise attacks, a BEC-attack subtype where cybercriminals pose as vendors. Voice Phishing Attacks Similar to BEC attacks, Vander Linden says voice phishing is used to trick employees into divulging sensitive or financial data. Again, bad actors pose as trusted vendors, HR personnel, executives, IT teams and more. Deepfake technology is a more sophisticated form of voice phishing, where bad actors can mimic people’s voices to gain access to your business. In the last year, AI-driven phishing attacks increased by 60%—a trend that’s likely to continue. SMS Phishing Attacks Phishing attacks continue beyond emails or phone calls. Cybercriminals can also infiltrate your employees’ cell phones via text message in an SMS phishing attack. Once again, scammers pose as known sources, such as a boss or colleague, to trick employees into clicking on suspicious links, sharing log-in credentials or otherwise compromising security. As with deepfakes, AI makes phishing attacks more realistic and harder to thwart, enabling scammers to mimic personal writing styles with startling accuracy. Supply Chain Attacks As part of a broad supply chain, retailers often have multiple integrations with third-party vendors—logistics providers, suppliers and payment processors. Some may even share login credentials. While these integrations optimize communication and data transfers, they also expose retailers to new threats. The supply chain is only as strong as its weakest link. Should a retailer’s vendor become compromised, attackers can take advantage of the retailer-vendor integration to gain entry to the retailer’s network. Once they’ve gained access, they can steal sensitive data, deploy ransomware and disrupt operations or more.

Fortify Your Defenses Top 4 Cybersecurity Risks Small Retailers Face

W ith cyberattackers constantly shifting tactics and growing supply chains and AI advancements, retailers of all sizes should be on the lookout for new threats. Here’s what to watch for—and how to strengthen security.

Business Email Compromise (BEC) Attacks

A BEC is a cyberattack when scammers leverage social engineering techniques to compromise a legitimate work email address to execute more believable scams or steal money or sensitive information, such as intellectual property or identifiable information. Once they’ve gained trust, they trick employees into making critical mistakes, such as authorizing fraudulent payments, releasing sensitive data or installing malware. Large companies aren’t the only ones at risk of BEC attacks. Companies with fewer than 1,000 employees have a 70% chance

34 Fall 2026 • Hardlines Strategies

Operations_Fall26.indd 34

7/28/26 10:18 AM