Retailers now face over a billion credential stuffing attacks annually. Even with a 9% average budget increase, most retailers still fail the latest PCI DSS compliance standard.
Key Takeaways
- Retail security budgets increased by an average of 9% in 2023
- 65% of retailers are not fully compliant with the latest version of PCI DSS 4.0
- The average retailer uses 75 different security tools across their infrastructure
- 37% of retail data breaches involve the use of stolen credentials
- The average cost of a data breach in the retail industry is $3.28 million
- It takes an average of 207 days for a retailer to identify a data breach
- Retailers faced 115 billion credential stuffing attacks in 2022-2023
- 30% of all global bot traffic is directed at the retail industry
- Account Takeover (ATO) attacks against retailers increased by 110% year-over-year
- Phishing accounts for 36% of all cyberattacks directed at the retail sector
- 1 in every 95 emails received by retail employees is a phishing attempt
- 86% of retail organizations were targeted by at least one successful phishing attack in 2022
- 77% of retail organizations were hit by ransomware in 2022, up from 44% in 2021
- The average ransom payment in the retail sector is $438,302
- Nearly 50% of retail cyberattacks involve the use of malware to exfiltrate customer data
Retail cybersecurity gaps remain wide as compliance, monitoring, and phishing risks drive rising costs and breaches.
Related reading
01 · Category
Compliance & Infrastructure30 stats
01
Retail security budgets increased by an average of 9% in 2023
02
65% of retailers are not fully compliant with the latest version of PCI DSS 4.0
03
The average retailer uses 75 different security tools across their infrastructure
04
48% of retailers struggle to monitor the security of their remote workers' connections
05
Cyber insurance premiums for retailers rose by 25% on average in the last year
06
72% of retailers have implemented Multi-Factor Authentication (MFA) for internal systems
07
33% of retail IT infrastructure is now hosted in the public cloud
08
55% of retail organizations have a dedicated Chief Information Security Officer (CISO)
09
Retailers spend 12% of their total IT budget on cybersecurity
10
20% of retail stores still use legacy Windows 7 or older for POS systems
11
Only 42% of retailers have a formal vulnerability management program
12
1 in 3 retailers failed their most recent security audit due to poor access controls
13
60% of retailers have an incident response plan, but only half test it annually
14
15% of retail cyber investment is dedicated to "Cloud Security Posture Management" (CSPM)
15
Retailers face an average of 3 regulatory investigations annually related to data privacy
16
40% of retailers cite "lack of skilled security staff" as their #1 infrastructure hurdle
17
88% of retailers require their third-party vendors to meet specific security standards
18
Deployment of Zero Trust architecture in retail grew by 15% in 2023
19
25% of retail security spend is allocated to endpoint protection systems
20
Infrastructure downtime due to cyberattacks costs retailers $400,000per hour on average
21
50% of retailers perform penetration testing only once a year or less
22
12% of retail IT budgets are wasted on redundant or underutilized security tools
23
Retailers in the EU are 20% more likely to encrypt data than US retailers due to GDPR
24
70% of retail CISOs report directly to the CEO or COO
25
35% of retailers use AI-driven tools to automate compliance reporting
26
18% of retailers have no policy for managing the security of IoT devices in-store
27
Cyber insurance claims in retail are denied in 10% of cases due to poor security hygiene
28
45% of retailers use a Managed Security Service Provider (MSSP) for 24/7 monitoring
29
Retailers prioritize IAM (Identity Access Management) as their top spending priority in 2024
30
92% of retailers believe that passing a PCI audit does not mean they are fully secure
Interpretation
Compliance & Infrastructure Interpretation
Even with a robust 9% budget increase, the retail sector's cybersecurity posture remains a patchwork quilt of advanced tools and alarming gaps, where throwing money at the problem hasn't yet solved the foundational issues of compliance, legacy systems, and human oversight.
02 · Category
Data Breaches & Privacy30 stats
01
37% of retail data breaches involve the use of stolen credentials
02
The average cost of a data breach in the retail industry is $3.28 million
03
It takes an average of 207 days for a retailer to identify a data breach
04
Personally Identifiable Information (PII) is involved in 98% of retail data breaches
05
15% of retail data breaches are caused by human error or accidental disclosure
06
70% of retail customers say they would stop shopping at a retailer that suffered a data breach
07
The cost per record lost in a retail data breach is approximately $164
08
25% of retail data breaches involve internal actors
09
Retailers that have an incident response team and plan save $1.2 million per breach
10
40% of retail data breaches occur through vulnerabilities in third-party supply chain partners
11
Consumer credit card information is the target of 60% of all retail breaches
12
13% of retail breaches are the result of physical theft of hardware
13
Small retailers (under 1,000 employees) see an average breach cost of $2.5 million
14
58% of retail security leaders believe their data is more vulnerable in the cloud than on-premise
15
10% of retail data breaches are attributed to nation-state actors seeking economic data
16
Misconfigured cloud databases account for 18% of retail data leaks
17
Retailers with high levels of security automation experience 50% lower breach costs
18
82% of retail data breaches involved a "human element" (soc. engineering or error)
19
The average time to contain a retail data breach is 69 days
20
Loyalty program data accounts for 12% of data stolen in retail breaches
21
Dark web listings for stolen retail customer credentials increased by 20% in 2023
22
33% of retail breaches involve scanning for open ports and services
23
Data breaches caused by lost or stolen devices cost retailers an average of $3.9 million
24
Only 28% of retailers encrypt all customer data at rest
25
45% of retailers say they have no way of knowing if a third-party partner was breached
26
5% of retail breaches are discovered by the retailer themselves; most are found by law enforcement
27
Post-breach legal costs for retailers average $580,000per incident
28
62% of retail data breaches are linked to financially motivated organized crime
29
Breaches involving the "Internet of Things" (IoT) in retail stores have grown by 150%
30
21% of retailers experienced a breach specifically targeting leur SQL databases
Interpretation
Data Breaches & Privacy Interpretation
Even the most trusted employee password is but a short, lazy stroll for a thief, leading to a shockingly expensive and slow-motion disaster where nearly every customer record is ultimately handed over, proving that in retail, the greatest threat to security isn't the software you didn't buy, but the human mistake you didn't train for.
03 · Category
E-commerce & Bot Attacks29 stats
01
Retailers faced 115 billion credential stuffing attacks in 2022-2023
02
30% of all global bot traffic is directed at the retail industry
03
Account Takeover (ATO) attacks against retailers increased by 110% year-over-year
04
Gift card balance checking bots increased by 200% during the holiday period
05
15% of retail revenue is lost to bot-driven fraud and inventory hoarding
06
Scalper bots account for 25% of traffic during limited-edition product drops in retail
07
28% of retail organizations have no specific strategy to mitigate bot traffic
08
Scraping bots steal pricing data from 60% of major e-commerce sites every 15 minutes
09
Credential stuffing has a 0.5% success rate, which is enough to compromise thousands of retail accounts daily
10
Magecart-style digital skimming attacks hit an average of 1,500 retail sites monthly
11
12% of e-commerce checkout pages contain at least one malicious third-party script
12
Only 35% of retailers use CAPTCHA or advanced bot detection at login
13
API-based attacks on retail platforms grew by 35% in 2023
14
50% of retailers have experienced a "denial of inventory" attack by bots
15
"Grinch bots" targeting toys and electronics caused a 40% uptick in infrastructure costs for retailers
16
1 in 4 retail mobile apps contains a vulnerability that could allow for account takeover
17
68% of retail bots are categorized as "advanced persistent bots" that mimic human behavior
18
Fraudulent account creation in retail increased by 64% in 2023
19
Retailers spend 10% of their IT budget specifically on e-commerce fraud prevention
20
22% of retail cart abandonments are caused by aggressive security verification steps
21
Formjacking, where attackers steal data from web forms, saw a 20% rise in the retail sector
22
Online retailers face an average of 200,000 bot login attempts per hour during sales
23
5% of e-commerce traffic is "click fraud" targeting retail advertising budgets
24
80% of retailers believe that API security is their biggest blind spot in e-commerce
25
Bot attacks during "Black Friday" are 3x higher than a typical day in the retail industry
26
Fake account registrations for loyalty programs increased by 45% in 2023
27
31% of retailers have experienced a DDoS attack targeting their web storefront
28
Digital skimming attacks take an average of 45 days to be detected by the merchant
29
42% of retail IT leaders cite mobile bot attacks as a growing threat to their revenue
Interpretation
E-commerce & Bot Attacks Interpretation
Retailers are fighting a war where the enemy is a tireless, automated army that steals from the till, hoards the shelves, and has the audacity to use your own checkout line to do it, all while a shocking number of stores are still checking the locks on the front door long after the bots have jimmied every other window.
More related reading
05 · Category
Ransomware & Malware30 stats
01
77% of retail organizations were hit by ransomware in 2022, up from 44% in 2021
02
The average ransom payment in the retail sector is $438,302
03
Nearly 50% of retail cyberattacks involve the use of malware to exfiltrate customer data
04
26% of retail organizations hit by ransomware paid the ransom to get their data back
05
92% of retail IT professionals reported a significant increase in the complexity of ransomware attacks
06
The volume of ransomware attacks in retail increased by 75% year-over-year in 2023
07
1 in 5 retail data breaches are caused by destructive malware meant to disrupt operations
08
Retailers face an average of 1,200 malware attempts per week per organization
09
Spyware accounts for 15% of all malware infections found within retail Point of Sale (POS) systems
10
43% of retail ransomware attacks start with a compromised credential exploiting a remote access tool
11
Ransomware recovery costs for retailers average $1.97 million per incident, excluding the ransom payment
12
Emotet malware remains the primary threat vector for 12% of retail banking credentials theft
13
67% of retail organizations recovered their data using backups rather than paying the ransom
14
34% of malware found in retail environments is delivered via encrypted HTTPS traffic to evade detection
15
Infostealer malware infections in the retail sector grew by 30% in the last 12 months
16
8% of retail devices are infected with "dormant" malware waiting for peak holiday shopping seasons
17
Retail organizations see a 40% spike in ransomware attempts during the month of December
18
55% of malware infections in retail occur through unpatched server vulnerabilities
19
Cryptojacking attacks on retail IT infrastructure increased by 143% in 2023
20
22% of retailers admitted to losing customer trust permanently after a ransomware infection
21
Ransomware hit 44% of small retail businesses with less than 500 employees
22
Adware makes up 33% of the total malware detected on retail endpoint devices
23
18% of retail organizations took longer than one month to recover from a ransomware attack
24
Malware targeting POS systems has evolved to include memory-scraping capabilities in 88% of cases
25
12% of retail malware is distributed via malicious advertising (malvertising) on shopping blogs
26
Ransomware-as-a-Service (RaaS) kits were used in 60% of retail attacks in 2023
27
Only 32% of retail employees can correctly identify a malware-laden file extension
28
47% of retailers use automated tools to scrub malware from web-facing applications daily
29
Mobile malware targeting retail shopping apps grew by 50% in the last year
30
The average time a ransomware actor spends inside a retail network before encrypting is 11 days
Interpretation
Ransomware & Malware Interpretation
While ransomware is turning retail's cash registers into ransom registers at a dizzying pace, with attacks ballooning and costs soaring, the silver lining is that a savvy two-thirds of retailers are telling hackers to take a hike by restoring from backups instead of paying up.
Reference
Cite This Report
This report is designed to be cited. We maintain stable URLs and versioned verification dates. Copy the format appropriate for your publication below.
APA
Diana Reeves. (2026, February 13). Retail Cybersecurity Statistics. Gitnux. https://gitnux.org/retail-cybersecurity-statistics
MLA
Diana Reeves. "Retail Cybersecurity Statistics." Gitnux, 13 Feb 2026, https://gitnux.org/retail-cybersecurity-statistics.
Chicago
Diana Reeves. 2026. "Retail Cybersecurity Statistics." Gitnux. https://gitnux.org/retail-cybersecurity-statistics.
Sources & references
51 datasets cited across this report
akamai.com