Your store has more entrances than the front door

Checkouts, back office, stockroom and online shop: a retailer with a store network has the same weaknesses again at every location. We walk through one store with you, digitally and on foot, and afterwards you know what the others look like.

  • PCI DSS evidence for Requirement 11
  • IT, checkout and access in one visit
  • Free initial consultation

The walk-through: four stations, one location

Front door Loading bay Shop floor Checkout Back office Stockroom Network cabinet Online shop and HQ 01 02 03 04
One location as a sample. What we find there usually holds for the whole network.
12.2%

of the cyberattacks Yarix observed in Germany in 2024 hit retail and e-commerce

annually

PCI DSS calls for a penetration test in Requirement 11, plus another one after every significant change

  1. 01

    Shop floor and checkout

    Stands outNetwork sockets under the counter, card terminals nobody checks for tampering, a guest Wi-Fi on the same segment as the merchandise system.

    We testPOS infrastructure and card terminals, segmentation between checkout, Wi-Fi and store IT, and on top of that the fake service technician as an agreed scenario.

  2. 02

    Back office and staff room

    Stands outThe transition from the shop floor to the back office is often a curtain or a door without a lock. Behind it, the store PC with someone logged in.

    We testTailgating and pretext scenarios during off-peak hours, screen locks and accounts on the store PC, phishing tailored to seasonal and store staff.

  3. 03

    Stockroom and network cabinet

    Stands outNetwork cabinet without a lock, access points within reach, suppliers coming and going through the loading bay without anyone signing them in.

    We testPhysical access to network and server components, open ports and default passwords on store devices, the connection to head office.

  4. 04

    Online shop and head office

    Stands outCustomer accounts, loyalty programmes, vouchers and returns logic form an attack space of their own, plus franchise partners with remote access to central systems.

    We testWeb application pentest of shop and loyalty programme, permissions at the interfaces to payment and logistics, third-party access from partners.

PCI DSS, Requirement 11: what the auditor wants to see

Requirement How we cover it
At least annually Once a year and after every significant change. Fixed cadence, re-test after changes
External and internal From outside and inside the cardholder data environment. Infrastructure pentest of the store network
Application layer Applications that card or customer data passes through. Web application pentest of shop and portal
Segmentation Separating the cardholder data environment in the network. Segmentation test on site

The report maps every finding to the matching requirement and goes to the PCI assessor as it is.

The picture

Only manufacturing accounted for more. Retail has no KRITIS sector of its own; only large food retailers fall under it via the food sector. The pressure comes from contracts, plus GDPR for customer accounts and the supplier audits of large groups.

Sources: Yarix analysis 2024, cited via security-insider.de; PCI DSS v4, Requirement 11.

Two orders of magnitude, the same pattern

A group

Marks & Spencer

United Kingdom · 2025

After a cyberattack, the retail chain had to suspend online orders for weeks. The company later put the impact on its operating profit at around 300 million pounds.

A single store

EDEKA store in Lower Saxony

according to media reports

An employee opened an email containing a supposed job application. Malware installed itself in the background, and the store's operations came to a halt. A single email was enough.

The attack scales. The defence has to as well.

Based on public reporting. Access Granted was not involved in these incidents.

What belongs in a store assessment

One location, one visit, four angles. Spot checks at further stores afterwards on request.

  • Physical pentest

    Access to back office, stockroom and network cabinet, how easily card terminals can be tampered with, how staff behave towards supposed technicians.

  • Social engineering

    Phishing and pretext scenarios for store and seasonal staff, evaluated per location rather than just per company.

  • Web app pentest

    Online shop, customer accounts, loyalty programme and the interfaces to payment and logistics, following OWASP and mapped to PCI DSS.

  • Infrastructure pentest

    Store network, segmentation towards the cardholder data environment, remote access by franchise partners and service providers.

Frequently asked questions

Are we, as a retailer, actually required to run a penetration test?

Legally, in most cases no; contractually, almost always: anyone accepting card payments falls under PCI DSS, and once you run your own cardholder data environment, Requirement 11 demands an annual penetration test plus one after every significant change. Violations carry contractual penalties and, in the worst case, the loss of card acceptance.

Can you test checkout systems without disrupting sales?

Yes. Active tests on tills and terminals are scheduled for off-peak hours or run on test devices; physical checks happen during normal trading without customers noticing. The store manager or someone you nominate is informed, the rest of the staff deliberately is not.

We have 80 stores. Do you need to visit every one?

No. We test one or two representative stores in full and carry the findings over to the whole network, because layout, technology and processes are usually standardised. After that, spot checks at further locations make sense, above all at franchise partners with their own equipment.

We are a regional retailer. Are we even a target?

The EDEKA store brought down by a job application email was one. Attackers look for the open door, and with standardised tills and store networks it is the same door in many businesses, whatever the size of the chain.

A single store is enough to understand the whole of your network.

We take one location apart completely, digitally and on site. A short call, then a fixed price.

All about the service: access-granted.de/en/branchen/retail

Request a store assessment Get in touch

Contact

Address
Albert-Einstein-Straße 1, 95028 Hof
E-Mail
hello@access-granted.de
Phone
+49 9281 5918506

AccessGranted X GmbH · HRB 7266 · Hof (Saale)

Company

Services

Regulatory pentests

Industries

© AccessGranted X GmbH Last updated: September 18, 2026