NZ retail businesses face a specific threat profile: point-of-sale system attacks, customer data breaches, online store vulnerabilities, and card skimming. The combination of high transaction volumes, customer trust data, and often-outdated POS systems makes retail a consistent target.
Retail cyber incidents tend to be high-volume affairs — an attacker who compromises a retail point-of-sale system doesn't steal one customer's card details; they steal every card processed through that terminal for however long the compromise goes undetected. The Target breach in the US (2013) stole 40 million card numbers from POS malware running undetected for two weeks. Similar attacks, scaled to NZ retail environments, are ongoing.
POS System Vulnerabilities
Many NZ retail businesses run POS systems on older Windows environments — Windows 7 or Windows XP in some cases — because POS software vendors have been slow to certify updated versions. End-of-life operating systems receive no security patches, making them permanently vulnerable to known exploits.
POS terminals that are connected to the same network as staff computers, office Wi-Fi, and general internet access are particularly at risk. An attacker who compromises any other system on the same network can potentially reach the POS system. Network segmentation — placing POS terminals on a dedicated, isolated network segment with no access to anything except payment processing endpoints — is the foundational POS security control.
E-Commerce Vulnerabilities
For NZ retailers with online stores, the vulnerability landscape is different. WooCommerce, Shopify, and Magento e-commerce platforms are heavily targeted through: vulnerable plugins (extensions that interact with payment or shipping systems and have known vulnerabilities), Magecart attacks (JavaScript-based card skimmers injected into checkout pages to capture card details in the browser before they're encrypted for transmission), and credential attacks on admin panels.
Magecart attacks are particularly insidious because the malicious code runs in the customer's browser — the retailer's server is never directly compromised, making detection difficult. The only reliable detection is regular integrity monitoring of checkout page JavaScript to identify unauthorised modifications.
Customer Data Obligations
Retail businesses hold customer email addresses, purchase history, shipping addresses, and sometimes stored payment information. All of this constitutes personal information under the NZ Privacy Act 2020. The obligation to protect this data and to notify the Privacy Commissioner and affected customers of any breach applies to retail businesses of any size.
Loyalty programs and email marketing lists represent particular concentrations of customer personal information. If a mailing platform account is compromised and the customer list is exfiltrated and used for spam or phishing, the retailer has suffered a notifiable privacy breach — even though their own systems weren't directly attacked.
PCI DSS: Card Payment Compliance
Any business that processes, stores, or transmits payment card data is subject to PCI DSS (Payment Card Industry Data Security Standard) requirements. The complexity of PCI DSS compliance depends on transaction volume and how cards are processed. For most small NZ retailers using an integrated payment terminal that processes cards entirely within the terminal (not via a software system), PCI scope is relatively contained — but the requirement to complete an annual self-assessment questionnaire and maintain basic security controls still applies.
Retail businesses process payment card data, hold customer personal information, and often run older POS systems — a combination that makes them consistent targets. Network segmentation, timely patches, and checkout page monitoring are the three controls that address the most common retail attack vectors.
