Retail and hospitality are being hit on two fronts at once.
Ransomware against retail doubling between holiday seasons, PCI DSS v4.0.1 fully mandatory, Privacy Act penalties reaching $50 million or more, and Scattered Spider turning helpdesk phishing into a repeatable playbook. The sector is being hit on two fronts at once: regulatory and criminal.
Why Retail and Hospitality are in the crosshairs
Five shifts shaping the consumer-operator threat environment — from helpdesk social engineering to vendor software cascades.
Scattered Spider has industrialised helpdesk social engineering
The group's 2025 campaign moved sector by sector — US and UK retail in April–May, insurance in June, airlines in late June. The tactic is consistent: call the outsourced IT helpdesk, impersonate a senior employee, request MFA reset or credential reset. NodeZero can't test a helpdesk's phone process, but insider threat and phishing impact testing show how far a valid employee credential reaches once an attacker has one.
Third-party IT and outsourced helpdesks are the attack surface
M&S says attackers got in through social engineering involving a third party. Clorox has publicly sued Cognizant, alleging its outsourced helpdesk repeatedly reset credentials without proper identity verification. Qantas's July 2025 incident involved a third-party contact centre.
Downtime-sensitivity drives payment pressure
Scattered Spider has targeted industries that face significant customer pressure and financial losses from the impact of even hours of downtime. Retail during the holidays, casinos on a Saturday night, airlines at summer peak — the pressure to restore operations creates pressure to pay. CyberCube flagged roughly 300 high-revenue companies at elevated risk, based on the technologies they run and their security conditions.
Customer data concentration is enormous and now regulated
Airline loyalty programs, hotel reward databases, retailer credit-card-linked accounts, and hospitality group PCI environments all hold concentrated, monetisable PII and payment data. Australia's strengthened Privacy Act penalties and global PCI DSS v4.0.1 requirements put direct financial exposure on every operator. Qantas's July 2025 incident affected 5.7 million records.
Vendor software ecosystems cascade the risk
CDK Global in June 2024 — a single dealer management software provider compromise cost US and Canadian auto dealers an estimated $1.02 billion in about three weeks. British Airways / Zellis / MOVEit in 2023 — a single payroll provider compromise affected employees at BA, Boots, BBC, Aer Lingus and more. Hertz / Cleo, disclosed April 2025 — customer data exposed via a file-transfer vendor exploited in late 2024.
What experts are saying
April started really strongly, continuing the momentum from last year, and then over the Easter bank holiday I got a call from one of the team to say they'd spotted some suspicious activity.
The adversary used help desk voice-based phishing in almost all observed 2025 incidents to compromise Microsoft Entra ID, single sign-on (SSO), and virtual desktop infrastructure (VDI) accounts.
Airlines and firms in the aviation industry consist of an attractive cocktail of critical infrastructure, sometimes outdated tech, and massive customer databases that can prove irresistible to hackers.
PCI DSS v4.0.1 is fully mandatory
All 51 future-dated requirements became effective 31 March 2025, so every assessment since includes them. Merchants must penetration-test at least annually and after significant changes, segmentation-test annually if they rely on segmentation to reduce scope (Req 11.4), and enforce MFA for all non-console access into the cardholder data environment (Req 8.4).
Any entity that stores, processes, or transmits cardholder data must comply with PCI DSS v4.0.1 — the Payment Card Industry Data Security Standard. PCI DSS has 12 principal requirements covering network security, data protection, vulnerability management, access control, monitoring, and security policy. All future-dated v4.0.1 requirements became mandatory on 31 March 2025. The Essential Eight is not mandatory for retail, but it is ASD's recommended baseline, and Essential Eight maturity level one is one of the cyber framework options for SOCI risk management programs.
Applies to any entity that stores, processes, or transmits cardholder data. All future-dated v4.0.1 requirements became mandatory 31 March 2025.
ASD's recommended baseline. Essential Eight maturity level one is one of the cyber framework options for SOCI risk management programs.
Retailers and hospitality businesses with annual turnover over $3M are bound by the Australian Privacy Principles when handling customer loyalty, booking, and employment data.
Where NodeZero applies
Relevant for retail technology providers, e-commerce platforms, and hospitality SaaS vendors managing customer data on behalf of merchants.
Where NodeZero applies
Adopted by larger retail groups and franchise operators to demonstrate security maturity to partners and payment processors.
Where NodeZero applies
72-hour ransomware payment reporting applies to businesses above the $3M turnover threshold under the Cyber Security Act.
Where NodeZero appliesA cascade of new obligations
Multiple new regulatory requirements are hitting simultaneously — each increasing the compliance burden and the consequences of failure.
PCI DSS v4.0.1 — Full compliance mandatory
31 Mar 2025All 51 future-dated requirements became effective 31 March 2025. Annual penetration testing (Req 11.4), segmentation testing — six-monthly for service providers, annual for merchants (Req 11.4) — and MFA for CDE access (Req 8.4) are all required.
Cyber Security Act 2024
30 May 2025Businesses with annual turnover above $3M, and SOCI responsible entities, must report ransomware payments within 72 hours of making them or becoming aware of them.
New Franchise Code of Conduct
1 Apr 2025The remade Franchising Code commenced 1 April 2025. Separately, each franchisor and franchisee covered by the Privacy Act must take reasonable steps under APP 11 to secure the personal information it holds.
SOCI Act — Food and grocery critical infrastructure
In effectFood and grocery is one of the critical infrastructure sectors under the SOCI Act. The largest supermarket retailers and food and grocery wholesalers own critical food and grocery assets, with mandatory Risk Management Programs and annual compliance reporting.
Find your organisation
See how the changes affect you specifically
Major retail chains
National and tier-1 retailers with dedicated security teams and PCI programmes; critical food and grocery operators carry SOCI Act obligations on top.
View details →Franchise networks
Franchise networks, from quick-service restaurants to retail, where shared POS and payment systems create aggregate attack surface across many locations.
View details →Hospitality chains
Hotel groups, casinos, pubs and venue operators running guest WiFi, property management and payment systems side by side.
View details →Why security teams trust NodeZero
Test your CDE isolation before your next PCI assessment
See how NodeZero produces PCI DSS v4.0.1 testing evidence for your retail or hospitality environment