Cart Before the Breach — Retail Sector Cyber Exposure & Supply Chain Intelligence
Based on ThingsRecon scans of 5 retail organisations
Why retail attack surfaces demand a different approach
Retail organisations manage some of the most exposed digital estates in any sector. Loyalty portals, e-commerce platforms, click & collect apps, partner integrations, payment gateways, and seasonal microsites accumulate quietly — each adding suppliers, scripts, and connections that your existing tools never mapped. When a customer hands over their card details or personal data, every third-party asset that touched that journey is a link in your attack chain.
This report draws on ThingsRecon agentless scans of five retail organisations — physical and online retailers operating across the UK and Belgium. Everything below was discovered from public data only: DNS, TLS certificates, cloud metadata, internet-wide scanning, and API ecosystem mapping. No agents. No questionnaires. No internal access. It is the same outside-in view an attacker builds — except we go one step further by naming the suppliers, scoring proximity to your customer-facing assets, and surfacing the ones your TPRM programme never asked about.
All organisations in this report are anonymised. Technology suppliers, platforms, and infrastructure providers are named as they appear on the external attack surface.
How do retail organisations compare?
ThingsRecon scanned five retail organisations simultaneously. All five received an overall cyber resilience score of C or below — reflecting the sprawling, supplier-heavy nature of modern retail digital estates. The data below is anonymised.
What every retail estate has in common
Across all five organisations, ThingsRecon identified consistent risk patterns — structural weaknesses that emerge from how modern retail digital estates are built, not from isolated security failures.
Discovery. Prioritisation. Monitoring.
Retail digital estates are among the most dynamic in any sector — driven by seasonal launches, platform migrations, third-party integrations, and omnichannel expansion. Static security tools built for known assets cannot keep pace.
Continuous Discovery
Seasonal microsites, click & collect portals, loyalty apps, and payment integrations appear and disappear faster than traditional asset management can track. ThingsRecon discovers your full external surface continuously — including assets your own teams don't know exist.
Risk Prioritisation
With 74 Fix Now items across five organisations and 199 Fix Soon, retail security teams need clear prioritisation — not a raw vulnerability list. ThingsRecon scores every finding by exploitability and proximity to customer data.
Supply Chain Monitoring
Tag management platforms, analytics providers, CDN configurations, and payment widgets change frequently. ThingsRecon detects these changes the moment they appear on your external surface — before they open a supply chain attack path.
The suppliers no TPRM questionnaire will find
Traditional TPRM focuses on suppliers you know about and chose deliberately. But retail digital estates are filled with implicit suppliers — analytics platforms, tag managers, CDN providers, certificate authorities, and JavaScript libraries that arrive embedded in platforms, themes, and third-party widgets. ThingsRecon maps all of them, scores their proximity to your most sensitive customer assets, and identifies the shared exposure across your sector.
Top 5 common suppliers across all 5 retail organisations:
Google Tag Manager and Analytics scripts are active on virtually every retail page — including product pages, account portals, and checkout flows. With an average digital proximity of 67%, Google's scripts sit closer to customer-facing assets than almost any other supplier in the retail estate. Magecart and formjacking attacks operate by compromising or misconfiguring third-party scripts at exactly this proximity level — a single misconfigured Google Tag Manager container can silently exfiltrate payment card data and customer PII from every transaction, without triggering a single firewall alert.
Aggregated risk signals across all 5 organisations
The following findings reflect aggregated patterns observed across all five retail estates. Individual organisation-level findings are available through a full ThingsRecon engagement.
- Fix NowHTTP security headers absent or critically misconfigured across all 5 retail estates. Missing Content-Security-Policy leaves customer-facing pages exposed to cross-site scripting and third-party script injection — the primary Magecart attack vector. All scanned retailers scored D or F on header hygiene.
- Fix NowOutdated software components with known CVEs detected in 4 of 5 retail estates. Fix Now software findings total 33 across the sector — publicly known vulnerabilities in JavaScript libraries, server-side frameworks, and platform components actively exploited in retail targeting campaigns.
- Fix NowSSL/TLS service misconfigurations generating Fix Now findings in 3 organisations. Weak cipher suites and misconfigured TLS on externally accessible services create man-in-the-middle exposure on customer account and payment flows.
- Fix SoonSession and authentication cookies missing security flags across all 5 estates. Cookies without Secure, HttpOnly, or SameSite attributes expose customer session tokens to theft — particularly acute during peak trading events when session volume is highest.
- Fix SoonApplication-level security controls inconsistently applied across loyalty portals, account management pages, and B2B partner interfaces. Gaps in authentication hygiene and input validation create pathways to customer account takeover at scale.
- MonitorSupplier certificate and DNS changes not tracked — certificate rotations, DNS record changes, and supplier ASN migrations across the 1,021 mapped supplier connections occur continuously. Without monitoring, supply chain changes that introduce new risk go undetected until after exploitation.
Your organisation's exposure — mapped in 48 hours
This sector report shows the patterns. A ThingsRecon scan of your organisation shows exactly which assets, suppliers, and attack paths apply to you — including the ones your current tools have never seen.