![\"Retail](\"https:\/\/dmsretail.com\/RetailNews\/wp-content\/uploads\/2022\/05\/RETAIL-ONLINE-TRAINING-728-X-90.png\")
<\/a><\/p>\n<\/p>\n
When devious young hackers <\/span><\/span><\/span><\/span><\/span><\/span>penetrated the computer networks<\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span> of major U.S. retailers and suppliers earlier this year, it was a significant test of the quiet cybersecurity collaboration happening among some of America\u2019s best-known brands and their much more obscure partners.<\/span><\/span><\/span><\/span><\/span><\/span><\/p>\n Amid increasingly worrisome attacks on life- and safety-critical sectors like energy, water and healthcare, cyber threats facing the retail and hospitality sector often get significantly less attention. But the retail industry is the country\u2019s largest private-sector employer, making its resilience vital to the U.S. economy. And over the years, <\/span><\/span><\/span><\/span><\/span><\/span>the Retail and Hospitality Information Sharing and Analysis Center<\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span> (RH-ISAC) has played an increasing role in protecting retailers of all sizes, from household names to obscure supply-chain linchpins.<\/span><\/span><\/span><\/span><\/span><\/span><\/p>\n The recent retail hacks, which experts have attributed to the cybercrime group Scattered Spider, demonstrated how companies have come together to defend themselves and one another, Pam Lindemoen, RH-ISAC\u2019s chief security officer and vice president of strategy, told sister publication Cybersecurity Dive.<\/span><\/span><\/span><\/span><\/span><\/span><\/p>\n \u201cThe retail sector has leaned into collaboration, sharing intelligence, best practices and response strategies,\u201d Lindemoen said.<\/span><\/span><\/span><\/span><\/span><\/span><\/p>\n The breaches linked to Scattered Spider \u2014 <\/span><\/span><\/span><\/span><\/span><\/span>a notorious and sprawling gang<\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span> largely made up of American and British teenagers and young adults \u2014 hit several retail giants in May and June, including <\/span><\/span><\/span><\/span><\/span><\/span>Victoria\u2019s Secret<\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span>, the Whole Foods distributor United Natural Foods and the department-store chain Belk. As other retailers took note of the intrusions and tried to avoid becoming the hackers\u2019 next victim, RH-ISAC stepped up to support industry-wide security efforts.<\/span><\/span><\/span><\/span><\/span><\/span><\/p>\n \u201cWe played a key role in coordinating responses to the threat,\u201d Lindemoen said.<\/span><\/span><\/span><\/span><\/span><\/span><\/p>\n It helped that the ISAC could lean on allies across the Atlantic Ocean who had just finished dealing with their own Scattered Spider attacks. Throughout April, hackers aligned with Scattered Spider breached the department-store chains <\/span><\/span><\/span><\/span><\/span><\/span>Harrods<\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span> and <\/span><\/span><\/span><\/span><\/span><\/span>Marks & Spencer<\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span> and the food retailer <\/span><\/span><\/span><\/span><\/span><\/span>Co-op<\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span>, prompting <\/span><\/span><\/span><\/span><\/span><\/span>urgent warnings<\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span> from British authorities.<\/span><\/span><\/span><\/span><\/span><\/span><\/p>\n Shortly after those attacks, RH-ISAC organized a briefing for its members with threat intelligence experts at Google\u2019s Mandiant division, Lindemoen said. The ISAC also coordinated with British companies to better understand the threat activity in the U.K., which helped prepare the group for when the hackers turned their attention to American retailers.<\/span><\/span><\/span><\/span><\/span><\/span><\/p>\n While Scattered Spider may be a collective of young cybercriminals, it poses a serious threat. The group eschews traditional vulnerabilities, instead relying heavily on social-engineering techniques such as tricking help desk workers into resetting account passwords. Because of their sometimes deep access to target companies\u2019 networks, the hackers have even been known to surreptitiously join virtual meetings that companies convene to plan responses to their intrusions.<\/span><\/span><\/span><\/span><\/span><\/span><\/p>\n The group\u2019s tactics are \u201ca stark reminder of [how], even with advanced technical defenses, the human vulnerabilities can be the weakest link,\u201d Lindemoen said. \u201cSince they\u2019re relying heavily on social engineering to bypass security controls, that just emphasizes that we have to [focus on] layered defenses.\u201d<\/span><\/span><\/span><\/span><\/span><\/span><\/p>\n Promoting layered cyber defenses is a major part of the mission of RH-ISAC, which was founded in 2014 in the wake of <\/span><\/span><\/span><\/span><\/span><\/span>a wave of cyberattacks<\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span>\u00a0on retailers such as Target.\u00a0(When it launched, it had roughly 30 members; it now has more than 290 \u201ccore members,\u201d including hotels, restaurants, retailers and consumer-goods manufacturers). The group facilitates conversations among members about the threat activity they\u2019re seeing, but Lindemoen said it <\/span><\/span><\/span><\/span><\/span><\/span>does more<\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span> than just help companies exchange indicators of compromise.\u00a0<\/span><\/span><\/span><\/span><\/span><\/span><\/p>\n \u201cOur members are actually sharing playbooks, response strategies and lessons that they learned in real time,\u201d she said.<\/span><\/span><\/span><\/span><\/span><\/span><\/p>\n In July, RH-ISAC partnered with other sectors\u2019 ISACs to <\/span><\/span><\/span><\/span><\/span><\/span>publish guidance about combating Scattered Spider<\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span>. The hacker gang \u201cpresents a real threat\u201d and poses \u201ca significant risk to organizations,\u201d the report said.<\/span><\/span><\/span><\/span><\/span><\/span><\/p>\nSuite of cyber defense services<\/span><\/span><\/span><\/span><\/span><\/h3>\n