A 30‑year‑old man has been charged with launching a cyberattack on the German subsidiary of Russia's state-owned oil giant Rosneft. The cyberattack, which happened in March 2022 in the aftermath of Russia's invasion of Ukraine, crippled the company's operations and cost millions of euros in damages.
Critical infrastructure organisations are once again being warned of the threat posed by malicious cybercriminals, following a ransomware attack against a state-owned energy company in Pakistan.
The retail playbook has been fundamentally rewritten. Customer journeys are omnichannel by default, IoT sensors are now omnipresent in both warehouses and shop floors, and AI is moving from pilot to P&L at an unprecedented pace. And the results are already proving transformative:
- Time-to-open: New stores and pop-ups are networked, secured, and POS-ready in days, not weeks.
- CX becomes predictive: Personalised offers and staffing respond to real-time signals, not yesterday's batch.
- Shrink is minimised: Vision-based loss prevention, plus better on-shelf availability.
- Cost-to-serve falls: Energy, logistics, and labour are optimised by rich streams of real-time date.
- Audits are boring (in a good way!): PCI and security postures are continuously and consistently maintained across estates and partners.
But in the race to access all these potential benefits, the winners aren't the ones with the flashiest demos – they're the ones with a rock-solid digital foundation that lets AI and IoT platforms scale safely, securely, and intelligently, store by store.
So, from Exponential-e's vantage point across cloud, connectivity, cyber, and communications, and our ongoing conversations with top retailers across the UK, here's what "AI/IoT-ready" actually means for the sector, and how we can begin laying those all-important foundations…
A network built for real-time, store-level intelligence
IoT and AI thrive on low latency and high availability, particularly when Point of Sale (PoS), inventory, and computer-vision workloads are increasingly interconnected. That means the underling WAN stops being a cost line and becomes a growth platform. Frictionless shopping experiences, incorporating queue-free checkout, real-time offers, and dynamic pricing, depend on fast, reliable data flows at the edge.
Software-defined networking, built on a private VPLS core, makes this practical at scale, offering centralised control, application-aware routing, seamless use of diverse access (i.e. ethernet, 4G/5G), and integrated security. Beyond the immediate operational advantages of avoiding hairpinning over the public internet and low, predictable latency, such networks offer the scalability and agility needed for pop-ups, seasonal peaks, and new store openings, where day-one uptime and policy consistency are required.
This should be complemented with enterprise IoT/M2M SIMs that deliver multi-carrier access and centralised control for store sensors, handhelds, lockers, smart signage, and similar devices.
Cloud and edge compute as a single, unified platform
AI-assisted retail is a hybrid sport: heavy training and data engineering in the Cloud, instant inference and control at the edge. To this end, retailers pursuing "always-on", augmented stores are converging 5G, IoT, and AI with edge compute to deliver truly personalised experiences in the moment, not hours later. This next-gen local processing, with edge computing implemented in every store, delivers a seamless PoS for customers, while simultaneously optimising staff's efficiency and reducing backhaul costs.
In the longer term, centralised data platforms and AI services can crunch multi-store telemetry for demand forecasting, replenishment, and customer analytics, offering a rich stream of actionable insights that enable reduced energy usage, automated restocking tasks, and smoother labour scheduling - immediate, powerful operational wins.
These capabilities can be developed into a standardised model and then be deployed, managed, and scaled consistently across new sites as retailers expand their operations. It's no surprise that multiple European retailers are already doing exactly this to not only protect their immediate margin and availability, but also accelerate their future growth plans.
Embracing the 'secure by design' model
Retail IT estates increasingly span POS, e-commerce, click-and-collect, and IoT devices. However, more devices and more data mean an increased attack surface, particularly when it comes to customers' payment data. As a result, robust security must be embedded in the design of all systems, platform, and processes, not bolted on later. Forward-thinking retailers are already rolling out this 'secure by design' approach, building customer trust through multi-layered, PCI-DSS-ready security ecosystems that allow for continuous monitoring and intelligently automated policy enforcement.
Secure Access Service Edge (SASE) has a key role to play here, converging network and security in the Cloud and offering numerous pathways to establishing identity-centric access, micro-segmentation of IoT devices, and uniform policies across stores and partners. Even with thousands of distributed end points, all this can be accessed through a single pane of glass - a "single source of truth" for all networks, devices, and workloads.
Taking the next step of your AI/IoT journey
AI and IoT in retail aren't separate projects; they must be treated as fundamental parts of a single, software-defined platform that reaches every shelf, sensor, and checkout. Build the network and edge right, wrap it with zero-trust security, and connect it to a governed data and AI backbone, then scale and optimise what works.
If you'd like this distilled into a tailored blueprint for your own estate (i.e. current stores, formats, and use-case priorities), we can map the stack, identify quick wins, and sequence the roadmap to outcomes, with everything overlaid by a single SLA, as a fully integrated service. Get in touch to discuss your own AI and IoT goals and let's make sure you're building on the right digital foundation!
The UK's National Cyber Security Centre (NCSC) has warned the IT helpdesks of retailers to be on their guard against bogus support calls they might receive from hackers pretending to be staff locked out of their accounts.
A UK firm has been hit by a £3.07 million fine after being hit by a ransomware attack that exposed sensitive data related to almost 80,000 people, and disrupted NHS services.
The UK government has proposed extending its ban on ransomware payments to cover the entire public sector in an attempt to deter cybercriminal attacks and protect taxpayers.
Stoli Group USA, the US subsidiary of vodka maker Stoli, has filed for bankruptcy – and a ransomware attack is at least partly to blame.
The American branch of Stoli, which imports and distributes Stoli brands in the United States, as well as the Kentucky Owl bourbon brand it purchased in 2017, was hit by a ransomware attack in August 2024.
2024 looks set to be the highest-grossing year yet for ransomware gangs, due - in no small part - to emboldened cybercriminals causing costly disruption at larger companies.
The so-called 'big-game hunting' cyberattacks which target larger, higher-value organisations have contributed to US $459.8 million paid to cybercriminals in the six months of 2024, according to a report by the cryptocurrency research firm Chainalysis.
Although the rise in money criminals have generated through ransomware has risen by what may appear to be a small percentage amount (approximately 2% from US $449.1 million to US $459.8 million), this is in spite of disruption caused to ransomware-as-a-service operations such as LockBit and ALPHV/BlackCat by law enforcement agencies.
The figures for the first half of 2024 include the US $75 million reportedly paid to the Dark Angels ransomware gang by an undisclosed Fortune 50 company, in what was believed to be the largest ever single ransom payment made since records began.
The ballooning size of maximum ransom payments represents a 96% year-on-year growth from 2023, and a 335% increase from the maximum payment made in 2022.
Chainalysis's research reveals that the median ransom payment made in response to the most severe ransomware has rocketed from just under US $200,000 in early 2023 to US $1.5 million by mid-June 2024.
The researchers believe that this 7.9x increase in the typical size of ransom payment (a nearly 1200x rise since the start of 2021) suggests that larger businesses and critical infrastructure providers considered more likely to agree to make higher payments due to their greater access to funds and the more significant impact of downtime.
Against this backdrop, the study claims that ransomware victims are giving in to extortion demands less often. As it explains:
Posts to ransomware leak sites as a measure of ransomware incidents have increased YoY by 10%, something we would expect to see if more victims were being compromised. However, total ransomware payment events as measured on-chain have declined YoY by 27.29%. Reading these two trends in tandem suggests that while attacks might be up so far this year, payment rates are down YoY. This is a positive sign for the ecosystem signalling that perhaps victims are better prepared, negating the need to pay.
In short, ensuring that your organisation had prepared to respond to a ransomware attack is essential.
Many organisations underestimate the importance of having a robust incident response plan. But knowing how to respond, especially in those critical first 48 hours after a cyber attack, can be critical.
Do you worry your company won't know how to recover after a cyber attack? Has your business just been hit by ransomware and you're wondering what to do?
There's still hope.
Don't make the mistake of believing that your organisation will never be targeted. The right approach is to take proactive measures in advance - as it's not a case of whether your business will suffer the likes of a ransomware attack but when.
Make sure to read Exponential-e's step-by-step guide on ransomware remediation.
Car dealerships have been brought to a standstill across the United States after a software provider was hit by a ransomware attack.
Newly-released research indicates that ransomware attacks reached a record high in May, with the surge primarily fueled by a massive increase in the number of attacks perpetrated by the LockBit ransomware group and its affiliates.
What's happened?
Recorded Future has reports that the British Government is proposing sweeping change in its approach to ransomware attacks.
Security agencies in the United States have issued a new warning about the Black Basta ransomware group, in the wake of a high-profile attack against the healthcare giant Ascension.
Do you know Dmitry Yuryevich Khoroshev?
If you do, there's a chance that you might well on the way to receiving a reward of up to $10 million.
Law enforcement agencies across the US, UK, and Australia have named Dmitry Yuryevich Khoroshev as the mastermind behind the notorious LockBit ransomware group, estimated to have extorted $500 million from companies worldwide.
The international hotel chain Omni Hotels & Resorts has confirmed that a cyberattack last month saw it shut down its systems, with hackers stealing personal information about its customers.
In the aftermath of the attack, hotel guests reported that they had been forced to check in on paper, that room keys didn't work, and all phone systems and Wi-Fi were offline.
Any organisation that has tried to recover from a ransomware attack knows that it can be time-consuming and costly. Companies hit by an attack must choose between paying a ransom or recovering encrypted data from a backup.
Unfortunately, ransomware gangs are too aware that they can leverage significantly higher ransoms from their corporate victims if they have also compromise the company's backups. For this reason, we are seeing more and more cyber attacks targeting backups because they know that organisations desperately need them to recover if they want to avoid paying a ransom to cybercriminals.
In October 2023, the British Library suffered "one of the worst cyber incidents in British history," as described by Ciaran Martin, ex-CEO of the National Cyber Security Centre (NCSC).
The notorious Rhysida ransomware gang broke into one of the world's greatest research libraries, encrypting or destroying much of its data, and exfiltrating 600 GB of files, including personal information of British Library staff and users.
© 2025 Exponential-e Ltd. Reg. No. 04499567, Reg. Address:100 Leman Street, London E1 8EU