Managing Retail Threats - Both Visible & Invisible
NRF: Why retailers need an enterprise-wide framework to manage threats

NRF PROTECT: Practical advice on risk intelligence for those on the front lines

As former director of the U.S. National Counterintelligence and Security Center, Bill Evanina is adept at dealing with high-stakes threats. But the list of threats - both visible and invisible - that retail loss prevention and cybersecurity executives face today is significant, Evanina told attendees at the NRF PROTECT conference at Cleveland's Huntington Convention Center.

"When we look at cyber, even within the cyber threat, it's complicated - from ransomware to DNS attacks and business email compromises all the way down to power outages and natural disaster," he said. "The retail ecosystem has a significant pressure point just in cyber alone."

Evanina also pointed out the very real physical threats experienced by retailers that get caught in the crosshairs of protests and violence.

The intelligence veteran recommends a holistic, "enterprise-wide focus for any company" when trying to mitigate risk. That includes bringing in other staff, management and leaders who are not part of the company's LP or security departments.

Evanina and Scott McBride, chief global asset protection officer and CSO for American Eagle Outfitters Inc., discussed the need for even the smallest of retailers to have a "risk intelligence function within an organization."

The employees for such a risk intelligence hub probably already exist within the organization, Evanina said.

There are a number of free resources to collect risk intelligence information, Evanina and McBride said, including signing up for state attorneys' alerts, and getting involved with Domestic Security Alliance Council and Overseas Security Advisory Council outreach programs. From there, retailers must dissect the threat intelligence and contextualize it to their own company's situation.

Failing to be a risk-aware leader and planning for all contingencies could be costly. "The enormousness of the threat that retail faces right now is across the board," Evanina said. nrf.com

Walgreens Facing Boycotts Amid High Political Tensions
#BoycottWalgreens trends after people say they were denied birth control pills, condoms
#BoycottWalgreens trended on Twitter after users shared stories of being denied birth control and condoms by pharmacists with a "moral objection" to their use.

Abigail Martin, a TikTok creator with almost 900,000 followers, said in a video uploaded on her page earlier this month that a pharmacist told her they will not refill her birth control prescription and she needs to call her medical provider.

Walgreens said in a tweet in 2018 in response to a question from a user that the company allows pharmacists to "step away" from filing a prescription if they morally object to it, but they should refer the prescription to another pharmacist or manager to meet a patient's needs in a "timely manner."

She said she called Walgreens, and another pharmacist told her she could refill her prescription. The pharmacist added that the pharmacy had been having issues with women being refused birth control in the past two weeks.

The outcry on Twitter comes in the aftermath of the Supreme Court overturning Roe v. Wade, which guaranteed a constitutional right to abortion. More than a dozen states have moved to ban or severely restrict abortion access following the the high court's decision in Dobbs v. Jackson Women's Health Organization. thehill.com

Retail Exodus Continues
From Gap to GameStop, there's a retail executive exodus underway - and more departures are coming

Don't expect the stream of departures from retailers' C-suites to stop anytime soon.

Already this year, Gap and Bed Bath & Beyond abruptly replaced their CEOs as the companies' sales plunged. GameStop fired its chief financial officer in the middle of the video game retailer's efforts to revamp its business. After sticking around to help Dollar General navigate the pandemic, the company's longtime CEO said he was retiring.

As the retail sector stares down an increasingly challenging landscape, experts say executive shakeups will likely become more common. Stimulus spending that boosted sales during the pandemic will no longer mask any underlying business struggles. Surging inflation is raising worries that shoppers will pull back on spending. And after the strain of the past two years, some executives are ready for a change of pace.

"Retail CEOs are going to have to earn their seats and earn their money, because their jobs just got a lot harder in the last six months," said John San Marco, a senior research analyst covering the retail industry at Neuberger Berman.

As pressure builds for retail executives to drive growth, there's a greater probability they'll disappoint boards and shareholders and be shown the door, San Marco said. In other cases, executives might see the writing on the wall and want to leave while they're still riding high. cnbc.com

More Closures Coming?
In the next few months, 60% of small retailers could shutter for good: report
Nearly half of small business owners, including 59% of retailers, say they're at risk of shutting down by the fall, up 12% from the 35% that were in that predicament a year ago, according to research from Alignable, an online referral network for small businesses.

Half of small retailers are cutting back on orders for the all-important holiday quarter, with 38% of those businesses saying they're reducing orders by more than 20% compared to last year, per the report.

Owners cite a host of reasons, including inflation, higher interest rates, gas prices, rent hikes, supply chain disruptions, lower consumer spending, fears of a recession and losses left over from 2020 and 2021. Consumers' current quandary - getting less for their money even as they shell out more - isn't helping small, independent retailers.

Retailers are among the industries where a great majority of small business owners say that inflation is hurting business more than the pandemic did, Alignable said. Many consumers have gone from enjoying some support from the federal government to help them grapple with the pandemic's challenges, to being left to handle price spikes on their own. retaildive.com

Retailers say swipe fees could add $2.5 billion in back-to-school costs
Swipe fees, which are charged every time a credit card is used to make a purchase, have long been a point of contention for retailers.

PVH taps H&M veteran as new supply chain chief

Amazon's Dash Cart Gets Updated, Expands to 1st Whole Foods Market

Gas prices have plunged 10 percent since their June peak

A Return to Office Could Be Inevitable

'Most Destructive Ransomware Group' Waiting to Strike Again
Post-Breakup, Conti Ransomware Members Remain Dangerous

The gang's members have moved into different criminal activities, and could regroup once law-enforcement attention has simmered down a bit, researchers say.

Two months after the infamous Conti ransomware gang ceased operations, several of its members remain as active as ever either as part of other ransomware groups or as independent contractors focused on data theft, initial network access, and other criminal endeavors.

Separately, they remain as dangerous to organizations as they used to be as members of a single gang, according to Intel 471. Its researchers have been tracking Conti actors as they have moved in different directions since the group dissolved in May.

The cessation of operations appears to be a bid by the group's operators to distance themselves from the brand more than anything else. In a new report, the threat intelligence firm speculates that once law-enforcement attention around the Conti group wanes, it's likely that its now-scattered members will regroup and form another criminal organization similar in structure to the original.

Most-Destructive Ransomware Group

The Conti group is widely regarded within the security industry as one of the most destructive ransomware operations of all time. The predominantly Russia-based group first surfaced in 2020, and has used a variety of tactics to break into victim networks - including via spear-phishing campaigns, stolen Remote Desktop Protocol credentials, software vulnerabilities, and poisoned software.

The FBI estimated that by January, the gang had collected some $150 million in ransom payouts from more than 1,000 victims worldwide-including more than 400 in the US. The scale of its destruction prompted the US State Department in May to announce a $10 million reward for information leading to the identification and/or location of key individuals of the gang. The State Department offered another $5 million for information leading to the arrest and conviction of individuals participating in attacks involving Conti ransomware incidents. darkreading.com

Google Drive & Dropbox Used to Deliver Malware
Russian hacking unit Cozy Bear adds Google Drive to its arsenal, researchers say
The state-backed Russian hacking team behind some of the biggest digital intrusions in recent years has been using both Google Drive and Dropbox to deliver malware against a range of targets, researchers said Tuesday.

Researchers with Palo Alto Networks' Unit 42 threat intelligence team said Tuesday that the Russian Foreign Intelligence Service (SVR) hacking unit - known as Cloaked Ursa by Unit 42, but more generally as APT29 or Nobelium or Cozy Bear - had previously used legitimate cloud services such as Dropbox as part of malware delivery efforts.

But in a series of spear phishing attacks dating back to early May, the hackers have demonstrated "sophistication and the ability to rapidly integrate popular cloud storage services to avoid detection," most notably by mixing Google Drive's cloud storage services into their mix.

"This is a new tactic for this actor and one that proves challenging to detect due to the ubiquitous nature of these services and the fact that they are trusted by millions of customers worldwide," the researchers said. "When the use of trusted services is combined with encryption, as we see here, it becomes extremely difficult for organizations to detect malicious activity in connection with the campaign."

Dropbox and other cloud and web services such as project management app Trello and Google's Firebase app development platform aren't new to the APT29 playbook, as documented in April 2022 by Mandiant and May 2021 by the Microsoft Threat Intelligence Center. But adding Google Drive brings an additional layer of threat.

"Google's ubiquity, combined with the trust that millions of customers worldwide have in them, make their inclusion into this APT's malware delivery process exceptionally concerning," the researchers said. The findings highlight the ongoing potent threat of APT29, which the U.S. government has blamed for the SolarWinds hack, for instance, one of the worst hacks on record. cyberscoop.com

Vehicle Fleets at Risk
Unpatched GPS Tracker Security Bugs Threaten 1.5M Vehicles with Disruption

A GPS device from MiCODUS has six security bugs that could allow attackers to monitor 1.5 million vehicles that use the tracker, or even remotely disable vehicles.

Six vulnerabilities have been found in a GPS tracking device used by businesses to monitor vehicle fleets, and by consumers as an anti-theft device. If exploited, they could allow attackers to widely disrupt fleet operations and track individual vehicles.

That's according to cybersecurity firm BitSight, which stated in a Tuesday advisory that the device, the MiCODUS MV720, has vulnerabilities in both the device and the back-end service. These pave the way for man-in-the-middle (MitM) attacks, authentication bypasses, and location tracking. The vulnerabilities include a hard-coded device password that allows access via SMS requests, and a default password on the API server, BitSight found.

"The exploitation of these vulnerabilities could have disastrous and even life-threatening implications," BitSight states in the report. "For example, an attacker could exploit some of the vulnerabilities to cut fuel to an entire fleet of commercial or emergency vehicles. Or, the attacker could leverage GPS information to monitor and abruptly stop vehicles on dangerous highways."

The vulnerabilities include a hard-coded password that could allow commands to be sent to devices, the ability to use administrator privileges for commands, and a default password of 123456. Flaws of lesser severity include a reflected cross-site scripting (XSS) issue and the ability to directly access parts of the application. Five of the vulnerabilities have been assigned identifiers under the Common Vulnerabilities and Exposures (CVE) program: CVE-2022-2107, CVE-2022-2141, CVE-2022-2199, CVE-2022-34150, and CVE-2022-33944. The default password security weakness was not considered a vulnerability, and so did not get a CVE identifier. darkreading.com

Cyber Insurance Premiums Surge - Driven By Ransomware
82% of global insurers expect the rise in cyber insurance premiums to continue
A Panaseer survey of global insurers across the UK and US found that 82% are expecting the rise in premiums to continue, with 74% of insurers agreeing that their inability to accurately understand a customer's security posture is impacting price increases.

Insurers also see the increasing cost of ransomware as a leading factor (78%) affecting premium rises, with largest ransom pay-outs by insurers in the last two years averaging £3.26m in the UK and $3.52m in the US.

The cyber landscape is continuously evolving. Ransomware is now considered the greatest cyber threat to the UK, while the US was the most targeted region in 2021, accounting for 53% of all ransomware attacks globally. To help combat the ransomware crisis, researchers found that 87% of insurers want a consistent approach to analysing cyber risk, and 89% want direct access to customer security metrics and measures proving the status of security controls. helpnetsecurity.com

Boosting Resilience to Cyber and Hybrid Threats
VIDEO: What NATO's virtual rapid response cyber capability means for the fight against cyber warfare
At the recent meeting of the North Atlantic Council in Madrid, NATO heads of state agreed to boost resilience to cyber and hybrid threats.

NATO members will strengthen their cyber defenses through enhanced civil-military cooperation, and expand industry partnerships. Allies have decided, on a voluntary basis and using national assets, to build and exercise a virtual rapid response cyber capability to respond to significant malicious cyber activities.

In this Help Net Security video, Itay Bochner, Director of Malware Analysis Solutions, OPSWAT, talks about NATO's virtual rapid response cyber capability and what it means. helpnetsecurity.com

5 Cybersecurity Questions CFOs Should Ask CISOs

Security Cameras & Video Doorbells Not Stopping Porch Pirates
Porch pirates are stealing my packages, but now I have a secret weapon

'The number of packages stolen from doorsteps has soared. Security cameras and video doorbells haven't helped me'

You may have spotted a porch pirate in the wild, too - they are everywhere. Online purchases rocketed during the pandemic and so did package theft - on both sides of the Atlantic. In my Philadelphia neighbourhood, thieves often follow delivery vans and dress in hi-vis vests or Amazon uniforms to deflect suspicion. Ordering online has become like a real-life gameshow: you have five minutes to grab your stuff before someone else does.

Package theft is obviously not the biggest issue facing the world - usually, the company you ordered from will send you a replacement - but it still feels violating and frustrating to have your stuff stolen so brazenly. Particularly as the police don't really care and there is nothing you can do about the problem other than stop ordering things to your house.

You know what definitely doesn't deter package thieves? Video doorbells or security cameras. There was a video doorbell on our house when we moved in, so I activated it thinking it might be useful. All it does is record footage of the porch pirates at work, which somehow just adds insult to injury. The doorbell also sends you so many notifications that you can transform from a normal person into a paranoid freak within days.

The one upside I've found to rampant package theft is that it has been a good way to meet the neighbours. There is a lovely old lady across the street called Norma who has taken it upon herself to be the neighbourhood watch. She sits outside her house on a folding chair most days and grabs packages whenever she sees them, which is extremely helpful. The only problem is that now I never know if a thief has the package or if Norma's got it.

Anyway, there are three morals to this story: 1) secure your food scraps, 2) get rid of your video doorbell, and 3) find yourself a Norma. theguardian.com

Amazon's UK Hiring Spree
UK: Amazon plans 4,000 more jobs in the UK this year, defying tech downturn

Amazon says it will create more than 4,000 permanent jobs in the U.K. in 2022.

Amazon announced Friday it would create more than 4,000 permanent jobs in the U.K. in 2022, defying a wave of job cuts in the tech industry.

The roles will include job functions in software development, product management, and engineering, as well as operational duties in fulfilment centres, sort centres and delivery stations.

Additional staff will be added in a number of regions across the U.K., including Wakefield and Knowsley in northern England, where the firm is opening two new Amazon fulfilment centers.

The hiring push will bring Amazon's permanent workforce in Britain to over 75,000, the company said.

"We're continuing to invest in talent right across the U.K.," John Boumphrey, Amazon's U.K. country manager, said in a press release.

"People join us not just for the wide variety of roles, great pay and benefits, but for the career development opportunities we provide."

The company's U.K. hiring spree marks a contrast with other parts of the tech industry. The sector is reckoning with a reversal in fortunes lately amid rising inflation and higher interest rates. Major firms including Microsoft, Netflix and Robinhood have slashed varying numbers of jobs, among other cost-cutting measures, in anticipation of slowing economic growth. cnbc.com

Vallarta Supermarkets adopts white-label e-commerce platform

Ethnic Grocers Are Redefining Online Shopping

Update: Hartford, CT: Multimillion-Dollar Theft Ring Member Gets 7 Years in Prison
A member of a theft ring that committed more than 180 burglaries and eluded police in dozens of car chases in Connecticut and New York was sentenced Tuesday to more than seven years in prison. Josepher Cartagena, of the Bronx in New York City, appeared before a federal judge in Hartford, Connecticut, after having pleaded guilty in February to possession of stolen property. Four other people, including Cartagena's brother, were charged in the burglary spree, which targeted mostly car dealerships and cell phone stores from June 2020 to January 2021 and netted more $4 million in stolen property, federal prosecutors said. The group stole cars, cell phones, electronics and even ATM machines, prosecutors said. Cartagena's lawyer, Jon Silveri, declined to comment after the hearing. In court documents, he wrote Cartagena acknowledged taking part in the thefts and regretted his actions but denied being a leader of the ring like prosecutors alleged. nbcconnecticut.com

Lathrop, CA: Police busts group believed connected with $40,000 in Target thefts
A group believed to be responsible for hitting as many as 50 Target stores as part of an organized retail theft operation are behind bars thanks to the Lathrop Police Department. According to the agency, officers last week were dispatched to the Lathrop Target location after receiving a report of a theft in progress - detaining three suspects including one that had stolen property in their possession. During the course of the investigation officers discovered that the group - which actually included a fourth person, presumably serving as the getaway driver, that fled when officers arrived - had hit multiple Target locations in the East Bay Area before coming to Target. A deputy from the Alameda County Sheriff's Office responded to Lathrop with a witness that identified the three individuals as those that had conducted the earlier robberies, and further inquiry determined that the group was responsible for hitting nearly four dozen Target locations and stealing more than $40,000 worth of merchandise. "This was outstanding police work and communication between Target, Dispatch, Officers, and outside agencies," the Lathrop Police Department said in a release announcing the bust. "Our officers are determined to go the extra mile to bring these cases to a conclusion." mantecabulletin.com

Palo Alto, CA: $50K Peninsula Lululemon Organized Retail Theft Ring Probed
Four suspects were arrested Sunday on suspicion of organized retail theft in connection with incidents at three Peninsula lululemon stores that occurred the same day, Palo Alto police said. A report of a shoplift in progress at the Stanford Shopping Center store led to the arrests of three adults and one juvenile, according to police. A fifth suspect, who is a man, remains at large according to police. Grafi Dumitru, 18, Elvira Fistogeanu, 22, and Florentina Izabela Matei, 20, were arrested on suspicion of felony organized retail theft, felony possession of stolen property and felony conspiracy, police said. The fourth suspect is a 16-year-old juvenile who was booked into juvenile hall on suspicion of the same offenses, police said. patch.com

St Joseph County, IN: Man arrested for 2021 robbery of an AT&T
A man was arrested for the robbery at an AT&T store in St Joseph County. It happened on April 12, 2021, when officers were called to the AT&T on Ironwood and S.R 23 on reports of a robbery. Witnesses told police that four men wearing face masks came into the store, told people to face the wall, and had employees put phones in their bags. ABC 57 News reports that an employee put a GPS tracker in one of the bags. The men stole 70 phones, with a total cost of $51,015.24. Police found three of the four the next day. On Friday, July 15, Davlon Baker was arrested on charges of robbery and theft, in relation to the robbery. He is due back in court on July 28. 953mnc.com

Destin, FL: Ulta Beauty issues statement after $8,000 store theft
Ulta Beauty issued a statement to WKRG News 5 regarding three people arrested for stealing $8,000 in merchandise from the Destin store.

While we do not share policies externally, the safety of our guests and associates is always our highest priority. We believe creating wow experiences with engaged, in-store associates helps prevent shoplifting but unfortunately theft still occurs. Our policies and practices include a variety of best practices and trainings designed to ensure the safety of our guests and associates and mitigate threats. We can confirm that the Ulta Beauty location in Destin was targeted by criminals who were arrested. Our team will continue to work with law enforcement on the matter. - ULTA PUBLIC RELATIONS

A store employee called Okaloosa County Sheriff's Office for the theft Sunday, July 17. The employee told OCSO the three suspects came in with large bags and began to fill them with perfumes and other valuables. The three ran out of the store and drove off, according to OCSO. All three were captured with K9 help from OCSO and the Walton County Sheriff's Office. wkrg.com

Estero, FL: Two women arrested in Miromar Outlets retail theft' $3,500 in merchandise