Cyberattacks against Australian retail tripled: Imperva

Imperva, the cybersecurity firm whose mission is to help organisations protect their data and all paths to it, releases The State of Security Within eCommerce 2022, a 12-month analysis by Imperva Threat Research of cybersecurity threats targeting the retail industry. 

A range of automated threats, from account takeover, credit card fraud, web scraping, API abuses, Grinch bots, and distributed denial of service (DDoS) attacks, were a persistent challenge for Australian eCommerce, threatening online sales and customer satisfaction.

 The continued barrage of attacks on retailers' websites, applications, and APIs throughout the calendar year and during the peak holiday shopping season is a continued business risk for the retail industry. 

In Australian retail, overall cyberattacks have almost tripled (285%) in H1 (Jan-Jun) 2022 compared to H2 (Jul-Dec) 2021. 

Notable growth has come from automated threats, which make up 69% of all security incidents in the past 12 months. 

Within this category, there has been a sharp rise in account takeover (ATO) attacks, a form of online fraud in which cybercriminals attempt to compromise online accounts by using stolen passwords and usernames. 

In the peak shopping period of Q4 (Oct-Dec) 2021, ATO attacks increased fourfold (315%), compared to the previous quarter. In H1 (Jan-Jun) 2022, ATO attacks were 185% higher than H2 (Jul-Dec) 2021.

"Events in recent weeks have highlighted that cybercriminals are targeting the personal data of Australians and the companies that hold that information," says Tony Mascarenhas, Area Vice President for Australia and New Zealand, Imperva. 

"The holiday shopping season is a critical period for the retail industry, and security incidents could disrupt business operations, damage consumer trust and undermine retailers' bottom line. Retailers need to be reviewing their cybersecurity defences to ensure their data stores are properly protected, as well as the pathways to those data stores, namely the applications and APIs that connect to the data."

"The fact that the majority of threats against retailers are automated and operate around the clock highlights the need for a unified approach, one that focuses on the protection of data and is equipped to mitigate attacks quickly without disrupting shoppers." 

In the past 12 months, nearly 40% of traffic on retailers' websites didn't come from a human. Instead, it came from a bot, software applications controlled by operators that run automated tasks, often with malicious intent. 

In the retail industry, the infamous Grinch bot is notorious for inventory hoarding during the holiday shopping season, scooping up high-demand items and making it challenging for consumers to purchase gifts online.

Of all the traffic on retailers' websites, nearly one-quarter (23.7%) was explicitly attributed to bad bots and malicious automation contributing to online fraud. Moreover, the proportion of advanced bots, scripts that use the latest evasion techniques to mimic human behaviour and avoid detection, on retail sites grew over the prior year (from 23.4% to 31.1%). 

Advanced bots are a considerable challenge for organisations to stop without the proper defences. 

In 2021, bot-related attacks on retail sites grew 10% in October and another 34% in November, suggesting that bot operators increased their nefarious efforts around peak holiday shopping.

In 2021, 64.1% of ATO attacks used an advanced bad bot. Of all login attempts on retail websites, 22.6% were malicious, nearly twice the volume recorded on sites across other industries. Additionally, attackers used leaked credentials 94.7% of the time in credential stuffing attacks targeting retailers, compared to 69.6% in other industries.

APIs are the invisible connective tissue that enables applications to share data and invoke digital services. 

Imperva Threat Research analyses that traffic from an API accounts for 41.6% of all traffic to online retailers' sites and applications. 

Of that, 12% of traffic directs to endpoints, like a database, where personal data is stored (credentials, identification numbers, etc.). More concerning, 3 - 5% of API traffic is directed to undocumented or Shadow APIs, endpoints that security teams don't know to exist or no longer protect. 

Exposed or vulnerable APIs are a considerable threat to retailers because attackers can use the API to exfiltrate customer data and payment information. 

API abuses are often done through automated attacks where a botnet floods the API with unwanted traffic, seeking vulnerable applications and unprotected data. 

In 2021, API attacks increased by 35% between September and October and then spiked another 22% in November on top of the previous months' elevated attack levels. This finding suggests that bad actors scale their efforts around the holiday shopping season as more data is exchanged between APIs and applications that power eCommerce services. 

A distributed denial of service (DDoS) attack is an automated threat that attempts to disrupt critical business operations by flooding the network or application infrastructure with malicious traffic. The attacks are often launched by a botnet, a group of compromised connected devices distributed across the Internet and operated by a single party. 

Imperva Threat Research finds that DDoS attacks in 2022 are more significant and robust across all industries. The number of incidents recorded that were greater than 100 Gbps doubled, and attacks larger than 500 Gbps/0.5 Tbps increased by 287%. 

Moreover, those targeted by an attack are often attacked again within 24 hours. Imperva finds that 55% of websites hit by an application-layer DDoS and 80% hit by a network-layer DDoS were attacked multiple times.

A DDoS attack is a non-stop threat to retailers. The downtime caused by a DDoS attack can lead to site disruption, reputational damage, and revenue loss. A DDoS is a critical threat to online retailers that rely on application performance and availability to enable digital store-fronts.