PCR Tech and IT retail, distribution and vendor news
UK retailers are experiencing a sharp rise in cyber attacks targeting customer-facing websites ahead of Black Friday and the Christmas trading period, according to data from SonicWall.
The cyber security vendor recorded 23.2 million high- and medium-priority intrusion prevention system (IPS) events and 399,530 malware threats across monitored UK retail environments between January and September 2026. The findings suggest attackers are concentrating on e-commerce platforms, customer portals and online checkout systems that process shopper data.
SonicWall said intrusion attempts against UK retailers are running at an annualised rate around 169% higher than 2025 full-year totals, with web application attacks accounting for 97% of all recorded activity.
The most common technique observed was directory traversal, responsible for 10.5 million events, or 45% of total IPS activity. These attacks attempt to access files that should remain hidden from public view, potentially exposing configuration data, records and credentials used to protect customer databases.
The company also reported that 41% of monitored sensors detected attempts to exploit a React Server Components remote code execution vulnerability. If successfully exploited, the flaw could allow attackers to take control of servers running affected applications.
Elsewhere, SonicWall recorded 1.6 million cross-site scripting attacks, a technique often used to steal customer information or hijack online sessions, and more than 263,000 attempts targeting systems vulnerable to the Log4j software flaw, despite the vulnerability being disclosed more than four years ago.
According to SonicWall, the activity indicates that cyber criminals are actively assessing retailers’ online infrastructure ahead of the sector’s busiest trading period, looking for vulnerabilities that could lead to data theft, fraud or service disruption.
Spencer Starkey, executive vice president EMEA at SonicWall, said: “Our data this year shows a clear pattern: silent reconnaissance against financial services, relentless stress-testing of healthcare, direct extortion against manufacturing, and now a full-scale mapping of Britain’s digital high street.
“Every one of these attacks is chasing the same prize: the names, addresses, passwords and card details customers hand over every time they shop online. A retailer’s website is its till, and criminals are testing every lock on it before the busiest trading weeks of the year.”
SonicWall warned that successful attacks can have consequences beyond the affected retailer, including payment fraud, account compromise through reused passwords and phishing campaigns using customer data. The company added that website outages during peak trading periods could leave orders delayed at a critical time for both retailers and consumers.
