Protect your customers' data in your online shop

Nowadays, shopping online is becoming more and more common. According to Statista data from 2021, almost 68% of all Spanish internet users shop online. The number of consumers using the online channel is growing, so retailers increasingly have more data that may be susceptible to cyber-attacks.   

We are going to tell you about the main cyber threats to online shops and how to avoid them.  

1. What sensitive data does your online shop handle?  

 When making a purchase, it is necessary for the customer to provide personal data that identifies him or her. For example, they must enter their name, e-mail address, telephone number, delivery address and bank card number for payment. This information is often very attractive to cybercriminals because of the financial benefit it often provides.  

According to Incibe's guide to cybersecurity in e-commerce, cybercriminals usually have several motivations when carrying out an attack. The first is usually the economic benefit they obtain from banking information or from the sale of personal data to third parties. However, in many cases their aim is to damage the business directly in terms of corporate image or to use their technological resources to distribute an attack.  

Whatever their objective, all attacks have a negative impact on the brand, in terms of reputation and trust.  

That is why it is essential that you put the necessary measures in place in your business to avoid potential risks. Below, we show you what the main attacks are, using Incibe's guide as a basis, so that you can identify them.  

 There are two types of cyberthreats depending on whether the attack is directed against people or the system, although many attacks usually involve both.  

In human-targeted attacks, cybercriminals seek to deceive people for financial gain or sensitive and confidential information. Most of these attacks are carried out against company employees, with the following types being the most common:  

• Social engineering. Cybercriminals focus on persuading or tricking a person with the aim of influencing their actions, based on the idea that, in any security system, the user is the weak link.   

• Express delivery. The attacker pretends to be a retailer to offer an express delivery by getting the user to make a bank transfer. Later, the attacker sends the shop a fake receipt to send the product to the customer. The merchant loses both the product and the money.   

• Spear phishing. The cybercriminal uses the customer's personal data on the internet (blogs, social networks...) to send a personalised e-mail pretending to be a retailer, attaching a file that installs a virus as soon as it is downloaded.  

Cyberthreats targeting the system usually exploit a weak point in the structure of the website to gain access and take control. Here are some of the most common targets:  

• Using third-party data to make a purchase in the online shop.  

• Installing malware on the online shop's system to obtain customer data, modify information on the site or use the structure to distribute the virus.  

Both threats can have a very negative impact on the image of your business, as it is very difficult to regain a customer's trust when they have experienced fraud associated with your brand 

.  

In addition, they can lead to large financial losses for your business.  

2. How can you protect data in your online business?  

First, raise awareness and train your employees. As we have already mentioned, prevention is important to identify and avoid threats.   

Secondly, perform system configurations and updates to make your software more secure. Some aspects to take care of are:  

• Have an SSL certificate.  

• Make backup copies.  

• Provide a secure payment gateway.  

• Enter passwords, limit permissions and encrypt files containing sensitive data.  

• Make sure that the hosting you have contracted is secure.  

• Introduce captcha systems.  

It is important that you also establish security protocols and contingency plans in case of problems. Having an action guide in place will not only allow you to minimise the impact of an attack, but you will also be able to reinforce the trust of your customers due to your quick response.  

As we have seen, you cannot control attacks against your e-commerce, but you can introduce measures to prevent and avoid the risk of a threat. Don't get caught!