Retail & Store Networks · PCI DSS & GDPR
Checkouts, back office, stockroom, online shop: a retailer with a store network repeats the same weaknesses at every location, staffed by people who may have started last week for the holiday season. Retail was the second most attacked industry in Germany in 2024. We walk through one store with you, digitally and on foot, and afterwards you know what the others look like.
The picture
12.2% of the cyberattacks Yarix observed in Germany in 2024 hit retail and e-commerce
According to an analysis by the security provider Yarix, 12.2% of recorded cyberattacks in Germany in 2024 targeted retail and e-commerce, second only to manufacturing. Unlike hospitals or utilities, retail has no KRITIS sector of its own; only large food retailers fall under KRITIS duties via the food sector. The pressure comes from contracts: anyone accepting card payments falls under PCI DSS, and anyone running their own cardholder data environment must, under Requirement 11, run a penetration test every year and after every significant change. Add GDPR for customer accounts and loyalty programmes, plus the NIS2 pressure that large groups pass down to franchise partners and service providers through supplier audits.
Sources: Yarix analysis 2024, cited via security-insider.de; PCI DSS v4, Requirement 11.
Where the pressure comes from
Accepting cards means PCI DSS. If you run your own cardholder data environment, Requirement 11 calls for an annual penetration test and another one after every significant change. Failing to deliver it risks contractual penalties and, in the worst case, card acceptance itself.
Customer accounts, loyalty programmes, returns: your shop and your tills hold personal data, and GDPR expects protection in line with the state of the art. Retail has no KRITIS sector of its own; only large food retailers fall under it via the food sector.
Large groups pass their NIS2 pressure downwards through supplier audits. Anyone connected as a franchise partner, service provider or supplier receives the questionnaires without falling under the law themselves.
Position 02
The peak day
In retail the risk moves across the day. When the floor is busy, a stranger stands out least, and at the same time nobody is allowed to touch the IT. When the store is closed, changes are allowed, but nobody is watching. The band shows both on top of each other.
Opportunity: Nobody is watching
Store closed, changes cleared
The only hours in which anyone may touch a till, a switch or the merchandise system. They are also the hours when nobody is in the store to notice an open cabinet door or an unfamiliar device on the network. Alarms and cameras cover the shop floor; the network cabinet in the stockroom often stays outside them.
Opportunity: The gate stands open
Loading bay open, freeze begins
The bay is open, suppliers come and go, goods block the corridor to the stockroom. Anyone entering in this hour with a hi-vis vest and a roll cage is rarely signed in. Meanwhile tills and card terminals boot up, and nobody checks whether something was added to a card reader overnight.
Opportunity: A lock against your own IT
Change freeze in force
From now until closing nobody may touch the production systems. A finding you report at ten stays open until the night. The freeze protects the takings and at the same time extends every window an attacker already has.
Opportunity: Nobody knows everyone
Staff rotation, freeze continues
Breaks, handovers, temporary staff in their second month. Anyone saying they are from the maintenance firm and here to swap the terminal meets nobody who can place them. The back office often stands open in these hours because people keep walking in and out.
Opportunity: Every disruption costs at once
Highest load, no changes allowed
Full floor, full tills, and a stranger stands out least of all. At the same time every minute of downtime costs takings directly, and the willingness to pull a system off the network for a check is at its lowest. Whoever strikes here gets the best cover and the biggest leverage at the same moment.
Opportunity: Working alone in the back office
Day-end closing, changes restricted
Cash-up, day-end report, counting the takings, often handled by a single person. The store PC is logged in, the door to the shop floor stands open, and the last staff members are busy tidying. For a pretext over the phone this is the most rewarding hour of the day.
The test date follows this band. Active checks on tills and terminals go where they cost you no takings, physical checks deliberately go into the hours when the floor is busy.
Position 03
The walk-through
Four stations we cover in every store assessment. The route is always the same: from the floor to the back, and from there into the systems at head office.
One location as a sample. What we find there usually holds for the whole network.
Station 01 · Shop floor & checkout
What stands out
Network sockets under the counter, card terminals nobody checks for tampering, a guest Wi-Fi on the same segment as the merchandise system. Someone in a hi-vis vest with a clipboard saying they are swapping the card reader rarely gets stopped.
What we test
POS infrastructure and card terminals for tampering, network segmentation between checkout, Wi-Fi and store IT, and the fake service technician scenario as an agreed social engineering test.
Stands out: 06 to 09 and 15 to 20
Station 02 · Back office & staff room
What stands out
The transition from shop floor to back office is often a curtain or an unlocked door. Behind it: the store PC with someone logged in, shift plans, sometimes the safe. Temporary staff do not know all their colleagues after two weeks.
What we test
Tailgating and pretext scenarios during off-peak hours, screen locks and accounts on the store PC, and a phishing simulation built for seasonal and store staff rather than head office.
Stands out: 12 to 15 and 20 to 24
Station 03 · Stockroom & network cabinet
What stands out
Unlocked network cabinet, access points within reach, suppliers coming and going through the loading bay without anyone signing them in. The cabinet is rarely the target, but often the route.
What we test
Physical access to network and server components, open ports and default passwords on store devices, the connection to merchandise management and head office.
Stands out: 00 to 09
Station 04 · Online shop & head office
What stands out
Customer accounts, loyalty programmes, vouchers and returns logic form their own attack space: account takeovers, points fraud, interfaces to payment and logistics, franchise partners with remote access to central systems.
What we test
Web application pentest of shop and loyalty programme, permissions at the interfaces to payment providers and stores, third-party access from partners and service providers.
Stands out: around the clock
Two orders of magnitude
Two publicly documented cases from recent years, deliberately far apart in size. Both receipts end with a figure that appeared in no plan beforehand.
A group
After a cyberattack, the retailer had to suspend online orders for weeks; product availability and logistics were affected. The company later put the impact on operating profit at around 300 million pounds.
Impact on operating profitaround 300m pounds
The attack scales. The defence has to as well.
A single store
An employee opened an email containing a supposed job application. Malware installed itself in the background and the store's operations came to a halt. It took neither a corporate group nor a head office, one email was enough.
Triggerone email
Based on public reporting. Access Granted was not involved in these incidents.
PCI DSS · Requirement 11
Requirement 11 of PCI DSS calls for regular testing of the security of systems and networks. For the pentest, that means:
| Requirement | What it means | How we cover it |
|---|---|---|
| At least annually | One penetration test per year, plus another after every significant change to infrastructure or applications. | Fixed test cadence, re-test after changes |
| External and internal | Attacks from outside against reachable systems and from inside the cardholder data environment. | Infrastructure pentest, store network included |
| Application layer | Web applications and interfaces carrying card or customer data, tested against the common vulnerability classes. | Web application pentest of shop and portals |
| Segmentation | Proof that the cardholder data environment is genuinely separated from the rest of the network, for example from the guest Wi-Fi in a store. | Segmentation test on site and from head office |
The report maps every finding to the matching requirement, so you can hand it to your PCI assessor as it is. That retail needs more political attention was recently raised by the CDU Economic Council, as reported by Handelsblatt: many stores, networked checkouts, sensitive payment data.
Ownership
In many retail businesses, physical security and IT security sit in two departments that rarely meet. The break-in happens exactly in the gap between them.
Knows shrinkage, cameras, locking schedules and behaviour at the gate. Sees the network cabinet in the stockroom as an IT topic.
The network cabinet behind an unlocked door. For one side an IT device, for the other a question of the room, and therefore unchanged for years.
Knows firewalls, POS software and the shop. Sees the back office door as the store manager's problem.
A combined assessment gives both the same report. Who fixes which item then sits as a line in the action list instead of getting stuck as a question of principle between two departments.
Modules
One location, one visit, four angles. Spot checks at further stores on request.
Access to back office, stockroom and network cabinet, tampering with card terminals, how staff respond to supposed technicians and suppliers.
Phishing and pretext scenarios for store and seasonal staff, evaluated per location rather than per company.
Online shop, customer accounts, loyalty programme and the interfaces to payment and logistics, following OWASP and mapped to PCI DSS.
Store network, segmentation towards the cardholder data environment, remote access by franchise partners and service providers.
Position 08
How it runs
Five steps that end with a report you can pass on. The route is the same for one store as it is for eighty.
Free and without obligation. We work out which store is representative, whether shop and head office belong in scope, and whether the report should be mapped to PCI DSS.
The scope is written down, the price is fixed. Dates follow your trading day and stay out of your peak season, so nobody has to leave findings open during the holiday trade.
Physical walk-through, social engineering and the technical checks run in the same period. The store manager or someone you nominate is informed, the rest of the staff deliberately is not.
Every finding with evidence, a risk rating and a remediation step, mapped to the matching PCI DSS requirement. We go through it with IT and store security together, so the action list ends up holding lines instead of questions of ownership.
Once things are fixed, we check the affected points again. PCI DSS asks for the same step anyway after every significant change to infrastructure or applications.
TotalA report that goes to the auditor as it is, and an action list you can reuse across the store network.
We take one location apart completely, digitally and on site, and afterwards you know what the others most likely look like. A short call, then a fixed price.
