Red Helix warns retailers over supplier cyber risk

Red Helix’s head of cyber security, Tom Exelby, has warned UK retailers to scrutinise suppliers’ access to critical systems after attacks exposed weaknesses across customer data, online trading and store equipment.

Writing in a guest commentary published by InternetRetailing, Exelby argues that supplier checks should focus on the damage a compromised connection could cause, rather than the value of the commercial contract. His warning draws on retail incidents during 2025, including an attack for which Co-op estimated lost sales at £206m.

What happened

Exelby points to incidents affecting ASOS and TFG London, alongside attacks on supermarket refrigeration systems in France, as evidence that retail cyber exposure reaches beyond a company’s own IT estate. Connections used by external service providers can also put physical operations at risk.

The warning that ASOS customer data may have been accessed in a cyberattack illustrates the information risk. Attacks involving refrigeration present a different commercial threat: equipment failure can leave retailers unable to keep perishable goods suitable for sale.

Other incidents show how disruption can spread into trading. Marks and Spencer stopped taking website and app orders for several weeks, while Co-op’s estimated sales losses demonstrate the financial exposure when normal operations are interrupted.

TFG London continued serving customers in stores despite delays to online orders. Exelby cites that separation as an example of how continuity arrangements can preserve some revenue-generating activity while affected services are being recovered.

Restoring technology is only part of that process. Retailers also have to clear operational backlogs, manage the consequences of interrupted sales and rebuild customer confidence after services have failed.

The background

Retailers combine large stores of customer information with operations that rely on connected technology. Contact records, buying histories and loyalty information make them attractive targets, while disruption can reach order-taking, checkout payments, stock replenishment and deliveries at the same time.

That combination gives attackers commercial leverage. Shoppers can move to competitors, fresh products cannot wait indefinitely for systems to return, and some lost purchases will not be made later. The consequences therefore depend on the affected business process, not simply the number of systems taken offline.

Exelby says one particularly active criminal group focused on retailers in the UK and US throughout 2025. Its targets included service desks, identity infrastructure and backup systems, exposing functions that businesses depend on both to control access and to recover from an attack.

The commentary cites figures showing that 69% of ransomware attacks in 2025 were executed outside normal business hours. It also reports misuse of legitimate remote-management tools in 78% of incidents, highlighting that attackers can exploit software already permitted within an organisation.

Years of outsourcing and integration have created another layer of exposure. Two suppliers that appear independent may use the same cloud platform or technology partner, leaving a retailer dependent on a common service that separate supplier reviews do not identify.

What people are saying

Exelby argues that a small support contract can carry greater cyber risk than a much larger supply agreement if the support provider has privileged system access. The relevant questions are what the supplier can reach, which information it holds and what would stop working if it failed.

The National Cyber Security Centre recommends matching security requirements to the risk posed by each supplier. In Exelby’s assessment, critical providers therefore warrant more than a routine questionnaire: retailers need evidence of access safeguards, monitoring and recovery arrangements that have actually been tested.

He also calls for contracts to set expectations around reporting incidents and managing subcontractors. Checks should continue after appointment, particularly when a provider’s services or permissions change, rather than being treated as a condition satisfied when the agreement was signed.

Help desks require particular attention because their role is to resolve problems quickly. A caller claiming seniority or urgency can exploit that service culture to seek access without passing adequate identity checks.

Following the 2025 retail incidents, the National Cyber Security Centre advised organisations to review identity verification for password resets, especially on privileged accounts. Exelby says those procedures should apply to outsourced support as well as internal teams, with management supporting staff who challenge apparently credible requests.

What happens next

Exelby recommends starting with a map of the services required to accept orders, take payments, replenish stock and deliver goods. Retailers should identify the organisations and systems behind each activity, extending that work to relevant subcontractors, integrations and shared infrastructure rather than stopping at their direct contracts.

The next task is to tighten supplier access. Permissions that are no longer required should be withdrawn, while remaining connections should be limited in scope and duration and subject to monitoring. The aim is to reduce the routes through which a supplier compromise could reach essential operations.

Incident exercises should involve operations, finance, legal and communications staff alongside IT teams and key suppliers. Those rehearsals need to establish who can authorise disconnection of a service, how orders would be fulfilled during disruption and which functions take priority in recovery.

Backup testing should reflect the recovery demands the business would face in practice. Monitoring also needs an escalation route outside internal teams’ working hours, with someone available to investigate alerts rather than leaving them unattended until the next shift.

Exelby proposes an independent review against a recognised standard, such as the National Cyber Security Centre’s Cyber Assessment Framework. Red-team exercises and simulated help-desk calls can then test whether documented controls hold up under realistic pressure, with weaknesses ranked by their commercial impact and testing repeated to track improvement.

For boards, his recommendation is to assign clear responsibility for these dependencies and demand evidence that the retailer could continue operating if an essential supplier or system failed. That places cyber resilience alongside stock availability and margins as an operational issue requiring directors’ scrutiny.