In recent months, the UK retail sector has been rocked by a series of high-profile cyber incidents. Major brands including M&S, The Co-op, Harrods, Dior, Tesco, and Sky have all fallen victim to attacks that have disrupted operations, compromised customer data, and damaged trust. Behind each of these incidents lies not just technical failures, but human stories – stories that deserve our understanding rather than our judgment.
We’re all vulnerable
The simple truth is that humans make mistakes. The colleague who clicked on a convincing phishing email, the team member who used the same password across multiple accounts, or the busy manager who postponed a critical system update… These aren’t acts of negligence; they’re moments of being human in an increasingly complex and stressful workplace.
The cyber criminal only needs to be right once. The defender needs to be right every time. It’s a constant battle where perfection is expected but is impossible to achieve.
The cost of blame culture
When a security breach occurs, our first instinct is often to ask: “Who’s responsible?” This blame-focused approach might feel natural, but it’s deeply counterproductive for several reasons:
- It drives incidents underground. When employees fear punishment, they’re less likely to report suspicious activities or admit mistakes quickly.
- It creates a false sense of security. Blaming individuals masks systemic vulnerabilities that will persist regardless of who’s at the helm.
- It hampers learning. Organisations focused on punishment rarely take the time to understand the complex factors that contributed to an incident.
In the cases of these retail giants, imagine the pressure on frontline staff managing digital systems while handling customer demands, seasonal rushes, and evolving technology. A blame culture wouldn’t have prevented these breaches – it would have simply ensured the next one goes unreported until it’s too late.
Cyber security: Not just an IT problem
Perhaps the most dangerous myth in corporate security is that cyber security belongs exclusively to the IT department. The attacks on M&S, Tesco, and others remind us that modern cyber security is a business-wide responsibility that touches every aspect of operations:
- Customer service teams need to recognise social engineering attempts
- Marketing must understand data protection when collecting customer information
- Finance requires protocols for verifying payment changes
- Leadership must prioritise and resource security initiatives
- Operations needs secure supply chain management
When M&S faced their security challenges, it wasn’t just their technical teams that were affected – it was their entire business ecosystem.
The power of awareness training
So what’s the solution? While there’s no silver bullet, comprehensive security awareness training forms the foundation of a robust human defence:
- Relevant and contextual: Training should reflect real-world scenarios relevant to each department’s actual work
- Continuous rather than annual: Security education should be ongoing, not a one-time compliance exercise
- Positive reinforcement: Reward reporting and vigilance rather than punishing mistakes
- Culture-building: Foster an environment where security consciousness becomes part of everyday work
The retailers who bounce back strongest from these recent incidents will be those who invest not just in technical fixes, but in building this kind of security-aware culture from the boardroom to the stockroom.
Beyond training: A layered approach
Of course, training alone isn’t enough. Today’s threats require a sophisticated, layered approach that includes:
- Managed detection and response (MDR): 24/7 monitoring and threat hunting that catches what humans might miss
- Immutable backups: Disaster recovery solutions that can’t be altered or deleted by attackers
- Zero trust architecture: Assuming no user or system is inherently trustworthy
- Security by design: Building protection into systems from inception, not as an afterthought
These technical solutions act as safety nets, acknowledging that human error is inevitable while ensuring it doesn’t lead to catastrophe.
United against a common enemy
In our efforts to strengthen cyber security, it’s crucial to recognise that security vendors and Managed Security Service Providers (MSPs/MSSPs) should be working together against a common enemy: the threat actors themselves. Too often, these essential partners view each other with suspicion or as competitors rather than allies in the same fight.
When retailers like M&S and Tesco face sophisticated attacks, they need a unified response from their security ecosystem, not fragmented efforts from providers protecting their turf. Consider how this collaborative approach transforms security:
- Shared intelligence: Vendors and service providers pooling threat intelligence create a more comprehensive picture than any single entity can develop
- Complementary expertise: Security product vendors understand their tools deeply, while MSPs understand client environments intimately. Together, they create solutions neither could alone
- Faster incident response: When security teams work seamlessly with external providers without finger-pointing, containment and remediation happen more quickly
- More robust solutions: Collaboration between vendors and service providers leads to more pragmatic, implementable security controls
The cyber criminals attacking our retail sector are collaborating effectively – sharing tools, techniques, and access. Our defence must be equally collaborative. The days of security vendors viewing each other as threats to their business models, or MSPs viewing vendors as competitors for client relationships, must end if we want to mount an effective defence.
Moving Forward Together
The attacks on Sky, The Co-op, and other retail giants serve as reminders of our collective vulnerability. Rather than pointing fingers, let’s use these incidents as catalysts for creating environments where:
- Mistakes are learning opportunities, not career-enders
- Security is everyone’s responsibility
- Training empowers rather than burdens
- Technical safeguards complement human vigilance
After all, cyber security isn’t just about protecting systems. It’s about protecting people. And that protection begins with understanding, empathy, and a commitment to growth rather than blame.
Is your organization still treating cyber security as just an IT problem? Are you fostering a culture of blame or a culture of learning? The time to evolve your approach isn’t after an incident – it’s now!
