Report: U.S. retailers aren't investing in cybersecurity even as breaches persist

U.S.-based retail stores are especially susceptible to damages caused by hackers. When these stores get hit by a data breach it could cost them, on average, roughly 19 percent of their customer base, according to a new, 448-person survey​ conducted by global audit, tax and advisory firm KPMG.

As high-profile hacks like Target, Home Depot and Eddie Bauer show, U.S.-based retail stores are especially susceptible to damages caused by hackers. A new survey out Tuesday shows how much that damage usually amounts to.

A data breach costs retail outlets, on average, roughly 19 percent of their customer base, according to a survey conducted by global audit, tax and advisory firm KPMG.

Nearly one-fifth of respondents told KPMG they would avoid a retailer that was the target of a successful cyber attack, regardless of how the company remediated damages caused by hackers.

Another 33 percent of people surveyed said they would wholly abandon an affected business for about three months, due to immediate fears concerning the exposure of personal and financial information typically stored by the retailer. Interestingly, these same customers also said they are least likely to return to a hacked store when its leadership fail to publicize a solid plan to prevent future cyber attacks.

“Make no mistake, there is a lot at stake here for retailers. Consumers are clearly demanding that their information be protected and they’re going to let their wallets do the talking,” Mark Larson, a KPMG executive who analyzes global retail market activity, said in a statement.

The typical American consumer has become more aware of cyber attacks, KPMG notes, as several high profile data breaches have recently occurred.

Though the survey’s findings may be considered worrisome for many retailers, 55 percent of sitting, senior cybersecurity executives serving the sector — separately surveyed by KPMG — said they had not invested in cybersecurity over the last 12 months.

“Quite frankly, many retailers are not doing enough to protect their businesses from cyber attacks or react to them when they occur, and the effects of their inaction will end up harming them in the long run,” said KPMG Principal and Retail Cybersecurity Leader Tony Buffomante in a statement.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure