e-Commerce cyber risks and how to prevent them

The main e-commerce cyber risks are ransomware, data breaches, malware and phishing, and the best prevention is a documented security strategy, timely software updates, encrypted connections, two-factor authentication and tested backups. An attack is a matter of when and not if, so executives should treat security as a business continuity decision.

Picture a Tuesday morning at a regional sporting-goods retailer. The operations manager calls the chief executive before eight o'clock because the online store shows a message from strangers where the product catalog should be. Orders have stopped, the payment gateway is not responding, and the customer service line is filling with calls. By noon, the board is asking three questions at once. How long will we be offline, what has been taken, and who needs to be told? This scenario is illustrative, but versions of it happen to real companies every week, and the companies that recover quickly are the ones that answered those questions before the morning arrived.

The moments we live in are among the most challenging for the business world. Today, to the operational risks characteristic of any organization, we must add the risk of business continuity that a cyber attack can generate.

The scale of the opportunity explains the interest of attackers. An earlier ICX estimate put e-commerce revenue at 431 billion dollars in 2021, with an expectation of 563 billion by 2025. That series does not specify its geographic scope, and it is much smaller than worldwide measures such as the forecast by eMarketer, which projected worldwide retail e-commerce sales of 4.921 trillion dollars in 2021. Whatever the exact figure, the direction is clear. This growth has been associated with a dangerous increase in the number of attacks an eCommerce platform is exposed to, with devastating consequences for companies with an online sales presence.

Being successful in e-commerce depends not only on offering good products and a smooth experience, but also on having a solid cybersecurity strategy in place. Platforms like Magento provide companies with tools to build scalable and customized online stores, but they also require the implementation of adequate security protocols to prevent threats. Attacks such as data breaches, malware and phishing can compromise customer information and severely impact brand reputation.

Magento provides a foundation for developing trusted eCommerce environments, incorporating features such as two-factor authentication, role-based access controls and frequent security patches. However, securing an online store goes beyond the default configuration. A proactive approach is needed that includes constant monitoring, regular updates, and the application of best practices in both code and infrastructure. This article discusses the main e-commerce cyber risks and how to prevent them when working with Magento. Identifying vulnerabilities and implementing effective measures allows companies to protect their operations, safeguard their customers' data and ensure long-term business continuity.

>> Essential cybersecurity for your store in Adobe Commerce <<

Is a cyber attack really inevitable for an online store?

A well-known line sums up the mindset. The version usually cited in the security industry is attributed to Robert Mueller, then director of the FBI, who said in a keynote at the RSA conference that there are only two types of companies, those that have been hacked and those that will be, as reported by Computerworld. The idea is that cyber attacks are a reality that our platform will not escape, so three questions will always arise.

1. When will the attack be?
2. What type of attack can we expect?
3. Are we ready?

When will the attack happen?

We cannot have a clear answer to this question, and it is not in our control. However, if we start from the fact that an attack is imminent, the best course of action is to act immediately so that we are ready when it arrives. Preparation is the only variable the company controls, and it is far cheaper to prepare than to improvise.

What kind of attack can we expect?

Ransomware is the threat most executives should keep in mind. ICX analysis has cited Hi-Tech Crime Trends as reporting a 931 percent increase in ransomware attacks between 2020 and 2021. The closest published figure is from Group-IB's Hi-Tech Crime Trends 2021/2022 report, which, as summarized by Infosecurity Magazine, measured a 935 percent year-on-year increase in double extortion attacks, with data from more than 2,300 companies posted on extortion sites between the second half of 2020 and the first half of 2021. The two numbers describe the same trend, and the precise one refers to victims whose data was published, not to every attack.

The political response confirms the seriousness. According to CNBC, in June 2021 the US Justice Department, through acting deputy attorney general John Carlin, said ransomware investigations would receive a priority similar to terrorism, a model the department had used before for terrorism but never for ransomware. In that sense the US Government has aligned the threat of ransomware with the challenge of terrorism.

Ransomware is a threat that usually has a devastating impact on e-commerce platforms. It restricts access to the trading system and conditions the possibility of operating on the payment of a ransom to remove the data encryption. Let us imagine this scene. One morning we are alerted that our eCommerce has been compromised and we cannot sell or transact, and our platform, instead of showing our products, displays a message from the attackers saying that our website has been hijacked. Some impacts are apparent, such as the loss of sales for the time the site is offline. Others are hidden and hard to measure, such as the loss of reputation and trust among our customers. After all, who would want to transact with a company whose security has been compromised?

Are we ready? Five elements to secure an eCommerce platform

The following elements are the ones we consider crucial when securing an eCommerce platform. None of them is exotic, and all of them are within reach of a mid-sized company.

Create a security strategy. The most important thing about security is a straightforward strategy, so that security actions are not isolated elements. When the organization does not have a defined plan, the actions taken become loose pieces of a puzzle that never gets completed, because nobody knows what the expected result was. A strategy states which assets matter most, who owns each risk, which controls are required, how incidents are detected and how the business continues while they are handled.

Cybersecurity in the financial industry: What are its risks and challenges

Keep the eCommerce platform updated. Many software updates close security holes, which are the focus of attention for cybercriminals, so it is essential to keep your e-commerce platform fully updated. ICX analysis has gone further and estimated that 90 percent of software updates correspond to closing security holes. That proportion is an internal estimate and not a published statistic. What is documented is the support model. Adobe's lifecycle policy gives each Adobe Commerce release a three-year standard support window that includes security patches, and a store that stays on an unsupported release stops receiving them.

Always obtain an SSL certificate. An SSL certificate is a digital certificate that authenticates a website's identity and enables an encrypted connection. Strictly speaking, SSL (Secure Sockets Layer) was deprecated and replaced by TLS (Transport Layer Security), although the old name persisted. According to Sectigo, the IETF formally deprecated SSL 3.0 in June 2015, and many certificate authorities still use "SSL certificate" as a colloquial term for certificates that enable encryption and authentication. Whatever it is called, installing and renewing the certificate protects online transactions and safeguards our customers' privacy and information.

Make security backups. In an eCommerce, it is crucial to perform recurrent backups of all the site's data, using specific tools available either through internal support or specialized companies. Backups are crucial for business continuity in case of data loss. A backup that has never been restored is only a hope, so schedule a restore test at least twice a year and keep at least one copy where an attacker who controls the production environment cannot reach it.

A fifth element ties the others together, which is an incident response plan. It names the people who decide, the order in which systems are isolated and restored, the contacts at the hosting provider, the payment processor and the insurer, and the messages that will be sent to customers and regulators. Companies that rehearse this plan once a year, even as a short tabletop exercise, discover missing phone numbers, expired credentials and unclear responsibilities while the cost of discovery is still low.

Why does the HTTPS protocol matter?

Google has promoted the HTTPS protocol (Hypertext Transfer Protocol Secure) because it improves on conventional HTTP by using SSL/TLS-based encryption for client-server traffic. It is vital because, if an attacker intercepts the data, the content remains inaccessible, which reduces the risk of certain man-in-the-middle and eavesdropping attacks.

ICX analysis has stated that Google penalizes pages that have not adopted the protocol. The documented position is more measured. When Google announced it in 2014, it described HTTPS as a very lightweight ranking signal affecting fewer than one percent of global queries, according to eWeek's report, with the stated intent of pushing site operators toward encrypted connections. The search effect is modest. The security and trust effect, particularly at checkout, is what matters to the business.

Why use two-factor authentication everywhere?

A strong password is essential, because weak and predictable passwords are the easiest to breach through brute force attacks. However, more important than the strength of the password is the second authentication factor, which is an additional step that is not easy for a cyber attacker to obtain, and which adds a crucial layer of information protection. CISA, the US cybersecurity agency, makes the same point in its guidance on multifactor authentication. It says passwords can be reused, cracked or stolen, that an attacker holding a stolen password cannot meet the second requirement, and that any multifactor method is better than none, with phishing-resistant methods preferred.

For an online store, the accounts that deserve it first are the administrator accounts of the commerce platform, the hosting panel, the payment gateway, the code repository and the email accounts that can reset all the others.

Read more: How to configure the wishlist in Magento

How do the risks differ by industry?

In retail and consumer goods, the exposure is seasonal and reputational. An outage during a peak campaign costs sales and brand trust at the same time. In financial services, the central concern is the protection of sensitive information and the expectations of regulators and auditors. In healthcare and education, portals that combine content and transactions hold personal data, so the cost of a leak includes notification duties and loss of confidence. In manufacturing and distribution, the main risk is often a compromised integration with the ERP, since an attack on the store can spread to systems that run production and logistics. In every sector, the attackers look for the same weaknesses, which are old software, weak credentials and untested recovery.

What does this mean for the C-level?

Today, business continuity is associated with our ability to protect our most precious assets, which are the systems through which financial transactions flow, the sensitive information we hold and any digital support whose compromise could harm the company. Security ceased to be a secondary issue and became a central axis of our business continuity strategy. After all, what we want is to be prepared to repel and contain any attempt that may arise, so it is vital to take action to protect our eCommerce platforms.

For the chief executive, the question is how long the business can survive without its online channel and who decides during the first hour of an incident. For the chief financial officer, the relevant numbers are the cost per hour of downtime, the insurance coverage and the budget for prevention compared with the cost of recovery. For the chief information and security officers, the priorities are a risk-based strategy, a patch policy, access control with multifactor authentication and a recovery plan that has been rehearsed. For the chief marketing officer, the issue is customer trust, which includes a prepared communication plan for the day something goes wrong.

Cybersecurity is no longer optional. It is a fundamental pillar of any e-commerce strategy. For companies operating with Magento, understanding the risks and taking steps to mitigate them is key to avoiding financial loss, loss of customer confidence and legal consequences. A single vulnerability can be enough to cause considerable damage.

What can I do on Monday morning?

Start with a one-page inventory of the assets that matter, which usually means the storefront, the admin panel, the payment flow, the customer database and the integrations with ERP and CRM. Next to each asset, write the name of its owner, the date of its last update and whether it is protected by multifactor authentication. The gaps in that page are your first priorities.

Then ask three questions of your technology team. When was the last successful restore from backup, and how long did it take? What is the oldest component in the stack, and is it still supported by its vendor? If the store were unavailable at ten o'clock on a Monday, who would be called, in what order, and who would speak to customers? Put the answers on the agenda of the next management meeting and assign dates. Magento provides the tools necessary to create a secure store, but the responsibility for maintaining that security rests with each business. Implementing layered protection measures, training your internal team and keeping up with security updates are essential steps in a comprehensive defense strategy.

To give the strategy a structure, the ICX Target Operating Model Toolkit offers a diagnostic checklist, an As-Is and To-Be template and an implementation roadmap that you can adapt to define who owns which security decisions and what the target state looks like.

How does ICX help?

ICX helps companies reduce cyber risk without slowing the business. Our cybersecurity consulting builds the security strategy, assesses the current posture and defines controls, monitoring and incident response. Our Adobe Commerce practice hardens and updates stores, reviews extensions and configures access controls, and our enterprise application services secure the integrations between the store and the systems behind it. For the commercial side, see our B2C eCommerce consulting and B2B eCommerce consulting.

Frequently asked questions

What is the biggest cyber risk for an online store? Ransomware and data breaches are the most damaging, because they combine lost sales, recovery costs and loss of customer trust.

Is a small store a target too? Yes. Attackers often scan for outdated software and weak credentials without regard to company size.

How often should we update our platform? Security fixes should be applied quickly, and routine releases on a planned schedule, always tested in a staging copy first.

Is an SSL or TLS certificate enough to be secure? No. It protects data in transit, but you also need updates, access control, backups and monitoring.

Where should we start? With an inventory of assets and owners, multifactor authentication on administrative accounts and a restore test of your latest backup.

Protecting your Magento store is protecting your brand, your customers and your revenue. By prioritizing cybersecurity, businesses can operate with confidence and build strong relationships in an increasingly interconnected environment. If you would like to review the security of your eCommerce, our team will be glad to talk with you through our contact page.