Retail & Hospitality Cyber Risks 2026
A 45-minute on-demand webinar on why UK retail and hospitality became attackers’ top target in 2025.
Paul Cragg, Norm Cyber
Ben Spraggett and Richard Beeston, Digital Space
- The M&S, Co-op and Harrods attacks, unpacked
- The six main ways attackers get in
- Closing the gaps, from staff training and 24/7 detection to recovery
- Why cyber belongs in your business continuity plan
Your recording is ready
Thanks, there. You can watch the full 45-minute session now.
Watch the recordingIt opens in a new tab. If you come back to this page in the same browser, you won’t need to fill in the form again.
One help desk call, seven weeks offline and £300m lost
That’s what one attack cost M&S. In the session with Norm Cyber, Paul was clear about how avoidable it was:
“It’s a very simple process change to implement, and it absolutely would have stopped the attackers on both the Co-op and M&S incidents.”
Paul CraggCTO, Norm Cyber
The recording covers
- How attackers are getting into retailers
- The warning signs to look for
- The quick help desk and MFA fixes you can make before peak trading
Five key takeaways
The 2025 attacks were process failures, not technical ones.
M&S lost around £300m in profit and seven weeks of online sales after a help desk employee reset an account and MFA token for an impersonator.
Retail and hospitality are prime targets.
Large distributed estates (EPOS, kiosks, guest Wi-Fi, IoT), lots of legacy kit, complex supply chains and high staff churn give attackers many ways in. Attacks are also highly visible, which raises the pressure to pay.
Simple fixes would have stopped the biggest attacks.
These include help desk verification before any password or MFA reset, phishing-resistant MFA, tight off-boarding and least-privilege access.
Speed of response decides the damage.
Co-op disconnected quickly and was back trading sooner than M&S. Most of the cost comes from lost trading and customer confidence, not the ransom.
Treat cyber as business continuity, not an IT problem.
Every business should plan for an attack, decide the minimum level it needs to keep trading, and be ready for tighter regulation such as the Cyber Security and Resilience Bill and PCI DSS v4.0.1.
Who you’ll hear from
Paul Cragg
CTO, Norm Cyber
Unpacks the M&S, Co-op and Harrods attacks, the six main ways attackers get in, and the simple fixes that would have stopped them.
Ben Spraggett
Senior Product & Trading Manager, Security, Digital Space
Shows how to close those gaps, from staff training and 24/7 detection to recovery.
Richard Beeston
CTO, Digital Space
Hosts and closes on why cyber belongs in your business continuity plan.
Includes a live Q&A on AI-driven attacks, why retail is targeted, and warning signs you may already be compromised.