'Tis the Season for More Cyberattacks
Retailers Urged to Brace for Cyberattack Surge During the Holiday Season

By the D&D Daily staff

As retailers gear up for the busiest shopping period of the year, cybersecurity experts are warning of a parallel surge—one that plays out behind the screens. The holiday season consistently sees a spike in phishing, ransomware, credential-stuffing, and point-of-sale (POS) attacks targeting retailers large and small.

The reasons are simple: higher online traffic, seasonal hiring, and the rush to meet demand create ideal conditions for cybercriminals. According to multiple industry reports, retail remains one of the top five most-targeted sectors for cyberattacks, with incidents increasing by as much as 30% between November and January in recent years. Threat actors know that retailers are often stretched thin, with IT and Loss Prevention teams focused on physical security and store operations.

Experts advise retailers to take immediate steps to shore up their defenses before peak season. That includes reviewing access permissions for seasonal employees, enforcing multi-factor authentication, and ensuring that all POS terminals, self-checkout systems, and connected devices are updated with the latest security patches. Network segmentation—isolating POS systems from customer Wi-Fi and other business networks—remains a simple but often overlooked safeguard.

Phishing remains the leading entry point for many retail breaches, and cybercriminals increasingly use convincing order confirmations or shipping-delay messages to trick employees into clicking malicious links. Security awareness training can be especially effective if conducted now, before temporary staff join the front lines.

Retailers are also encouraged to test their incident response plans—verifying who must be contacted in the event of an intrusion and ensuring backups are secure and recoverable. Coordination between Loss Prevention, IT, and store operations is crucial; the faster an organization can detect and isolate suspicious activity, the less damage it will sustain.

With consumer trust and brand reputation on the line, a single breach can quickly overshadow a successful holiday quarter. As one cybersecurity analyst put it, “Retailers can’t afford to treat cybersecurity as an afterthought during the holidays—it has to be part of the playbook.”


Mandatory Employee Phishing Training Helps
What keeps phishing training from fading over time
When employees stop falling for phishing emails, it is rarely luck. A new study shows that steady, mandatory phishing training can cut risky behavior over time. After one year of continuous simulations and follow-up lessons, employees were half as likely to take the bait.

The research, carried out by teams from various universities, offers a look at how behavior changes when training never stops.

Why long-term training matters

Phishing still kicks off most cyberattacks, and awareness training is standard practice. Still, many companies wonder if it actually works. The study followed more than 1,300 employees across 20 companies over a 12-month period to find out what works when phishing simulations are repeated regularly and backed by mandatory training.

Each employee received a series of simulated phishing emails during the year. When someone took an unsafe action, such as clicking a malicious link, the system assigned a short mandatory training session before the person could return to work. More than 13,000 phishing emails were sent in total, each one designed to test different psychological cues such as urgency, curiosity, or helpfulness.

By the end of the experiment, employees were making far fewer mistakes. Unsafe clicks and submissions dropped by roughly half within six months and then stabilized near the industry average for organizations that use ongoing training. The findings suggest that repetition and timing matter more than the format of the lessons themselves. helpnetsecurity.com


Do Businesses Have the Infrastructure to Support AI Surge?
AI agents worsen IT’s capacity crunch: S&P Global

An infrastructure overhaul to support agentic systems is underway, bringing with it a new set of capacity demands and security considerations.

Enterprise demand for AI agents is driving significant changes in infrastructure needs, according to an S&P Global report published Wednesday.

“Agentic systems consume significantly more IT capacity than chat-based systems as they break free of human pacing and launch multiple prompts and cascade into other agents,” S&P Global said in a release accompanying the report.

GPU shipment projections from leading suppliers have increased more than 500% for the 2025-2026 period compared with initial estimates released in 2023. The rapid investment growth comes as most organizations aim to deploy agentic tools.

As more enterprises actively pursue agentic AI adoption, the infrastructure considerations needed to support the technology are coming into clearer view.  cybersecuritydive.com


Wi-Fi signals may hold the key to touchless access control

Conduent warns of further financial fallout from cyberattack