Retail chains undercount attacks as incidents spread across sites
A VikingCloud survey of 200 security and IT leaders at U.S. and European retail chains found that 86% experienced an attack in the past year, and 77% of those saw it spread beyond the initial site. None of the 13 security technologies measured, nor real-time visibility, was linked to less spread, but a corporate policy mandate was. The survey also found that 80% of chains open a location before central monitoring and enforcement reach it.
VikingCloud questioned 200 security and IT executives from retail chains in the U.S. and Europe. It found 86% faced an attack in the prior year, and among them 77% said the intrusion moved beyond its origin into other stores, corporate systems, or shared vendors. Larger chains reported more spread: 89% at 2,500-plus locations versus 71% at smaller operators.
Only about half said headquarters writes security rules and makes every site comply. Where such a mandate existed, 64% of attacks spread; without one, 89% did. Separately, 80% launch a new store before central oversight and enforcement are active there, a gap that persisted regardless of mandate or chain size.
Retail customers, store employees, franchisees, and local communities could bear the consequences when intrusions spread across sites or go unreported. If material incidents do not reach executives or boards, fixes may be delayed and repeated weaknesses may persist. A corporate policy mandate may help franchise-heavy chains limit blast radius, but opening locations before monitoring and enforcement arrive could leave new stores exposed. The survey’s findings may push retail leaders to treat governance, not just tool purchases, as central to protecting people and operations.