Cyber spotlights on the retail, leisure and hospitality industry: Identify, assess, protect

This spotlight delivers an overview of the latest cyber risks impacting the industry, including recent incidents, and emerging threat vectors. We also highlight our specialised insurance solutions designed to address the unique cyber vulnerabilities faced by organisations in these sectors. Read more from our insights to help enhance your organisation’s cyber risk management approach.

What cyber incidents have we seen from the retail, leisure and hospitality industry?

Cyber insurance claims we have seen from the retail, leisure and hospitality industry

Below is a selection of recent anonymised claims managed by WTW:

Accidental data breach

Customers who logged into their online accounts were shown details of other customers due to a software issue on the part of their third-party service provider.

Malicious data breach

The company’s security team detected a higher-than-normal log-in attempts to online accounts and determined the unusual activity was the result of a brute-force attack.

Ransomware

The company suffered a ransomware incident that encrypted their servers and affected multiple locations.

Social Engineering: A HR employee at the company received an e-mail from an e-mail address purporting to be an employee of the company. The email was impersonating a newly hired employee and requested information on pay days and provided account details for the company to wire their wage to.

Social Engineering

A HR employee at the company received an e-mail from an e-mail address purporting to be an employee of the company. The email was impersonating a newly hired employee and requested information on pay days and provided account details for the company to wire their wage to.

Business disruption

The company’s central reservations system (provided by a third-party service provider) suffered an outage and, as a result, the company incurred a revenue loss.

A broker's insight: The volume of personal data collected by companies in the retail, leisure and hospitality sector continues to make the sector as a whole highly susceptible to data breaches The heavy reliance on information technology to facilitate revenue generation also continues to arguably make the sector disproportionately vulnerable to extortion threats. The recent cyber extortion event affecting CDK (see Recent Cyber Incidents) highlighted the potentially fragility of certain supply chain where industry sectors becoming reliant on a small number of vendors.

Source: WTW proprietary claims data

Cyber threat trends in the retail, leisure and hospitality sector

Increased reliance on third party distribution and fulfilment centres: Customers have increasingly high expectations around delivery timescales with nearly two thirds of global shoppers reportedly expecting 24 to 48 hours for their goods. This is driving pressure on “just-in-time” supply chains, reliance on third party logistic companies and an uninterrupted, continuous availability of their technology platforms. Disruption at one of these third party providers can have a significant impact on sales and reputation of the retailer relying on such platform.

Increasing frequency of IT supply chain attacks outages: There has been a notable increase in point of sale misconfiguration and technology outages in 2024 which have left large global retailers having to close stores until their systems were operational again. The CrowdStrike outage in July also impacted PoS systems globally and has highlighted the importance of non-malicious perils such as human error or system failure, especially in the context of cyber business interruption insuring agreements. Furthermore, events such as the incident impacting car dealerships in the United States described above bring focus to dependent business interruption coverage, both in respect of IT service providers and non-IT service providers.

Double and triple extortion techniques leverage reputational fears: large retail, hospitality and leisure organisations have a public presence, which means that a cyber-attack often becomes the headline news. Cybercriminals are acutely aware of the damage a public breach can have on these organisations. Increasingly, cybercriminals are turning to double or triple extortion techniques by crippling systems to cause service outages and infiltrate sensitive data, which they threaten to release publicly unless an extortion demand is paid. If that doesn’t secure payment, then the malicious actors threaten to launch distributed denial-of-service (DDoS) attacks.

Rising trend of SEO poisoning and brandjacking: We are seeing an increasing trend of threat actors using Search Engine Optimisation poisoning techniques to increase the position of their malicious copycat website to the top of a search page. This is done to harvest sensitive data and login credentials. Such angle of attack is particularly prevalent in industries whereby companies have a consumer exposure and are established brands. These attacks are extremely damaging for the reputation of the company and their digital trust.

Attack Vector: As Retailers and Hospitality organisations increasingly digitise their supply chains, depending on cloud-based services to protect their digital assets and host critical parts of their infrastructure, it’s imperative that organisations remain vigilant in the governance and strict management of their third-party dependencies. The CrowdStrike incident in July, although not a malicious attack, but with repercussions similar to software supply chains attack seen with Kaseya (2021) and CDK Global (2024), serves as a strong reminder of the vulnerabilities inherent in even the most robust systems. While it’s still too early to tell the final cost, it is estimated that the cost to the UK economy alone is £2.5Bn.

Learn more here keyboard_arrow_right

To defend against these types of systemic, supply chain events which can be either malicious or non-malicious in nature, organisations need to carefully plan, developing business impact assessments for their most critical systems and robust incident response plans. Through a clear understanding of their most vital systems, organisations can prioritize resource, response and recovery efforts effectively. Preventative steps such as conducting thorough security assessments of suppliers and enforcing strict vendor management practices and procedures including third party rollouts also play a significant role in reducing supply chain risk.

Learn more here keyboard_arrow_right

Our perspective on cyber market trends for the retail, leisure and hospitality industry

The Cyber insurance market has remained favourable for Retail and Hospitality clients both in regards to rate, often seeing double digit decreases, but also creativity in underwriting, which has brought numerous clients back to the Cyber insurance market after having exited in the hard market of 2020-21 when the Retail and Hospitality sector was one of the top four most severely impacted (WTW Cyber Retail & Wholesale Claims Report 2022). This was largely due to bricks and mortar clients commonly having some security controls falling below insurer requirements, typically related to legacy systems as IT budgets were impacted after the COVID-19 pandemic.

This year we have found that through the high levels of competition for core sectors such as Retail and Hospitality, rate has continued to reduce, supporting clients cost analysis on whether to increase limits or purchase Cyber coverage again. The creative underwriting demonstrated by some insurers is also producing far more favourable terms, particularly for more challenged clients without the restrictions of coverage previously experienced. WTW have secured the best result for these clients through supporting them in building deeper relationships with insurers who are willing to build a relationship for the long-term and in accordance with the clients IT roadmaps. Where we continue to see significant variation in underwriting approach and coverage, remains around privacy, in particular wrongful/ unlawful collection of personal information.

Finally, we have seen clients increasingly focus on structural leavers such as retentions to meet strict budgetary requirements and utilise analytics tools, such as WTW’s Connected Risk Intelligence, to optimise on cost efficiencies which can be generated through a portfolio lens.

How WTW can help with identifying, assessing, and protecting your business