Cyber Insurance for Retail & eCommerce

Cyber Threats Facing NZ Retail and eCommerce

Retail and eCommerce businesses in New Zealand face a broad and growing range of cyber threats. Every transaction processed, every customer account created, and every marketing database maintained represents potential cyber exposure. The volume of customer data held by even a small online retailer — addresses, payment card details, purchase histories, email addresses — makes retail one of the most frequently targeted sectors for data theft.

The stakes are particularly high for eCommerce businesses because a significant breach can result in near-immediate loss of customer trust, resulting in revenue impacts that persist long after the technical incident is resolved. In the interconnected world of online retail, news of a breach spreads rapidly through social media and review platforms.

Website Skimming: The Hidden Threat

One of the most insidious threats to eCommerce businesses is website skimming — malicious code injected into checkout pages that captures payment card details as customers enter them. This attack vector, also known as formjacking, is difficult to detect because the website continues to function normally while the criminal simultaneously harvests card data in real time. Skimming attacks have affected thousands of eCommerce sites globally, including many operated by small and medium NZ businesses using popular platforms like WooCommerce and Shopify.

Businesses that suffer skimming attacks face PCI-DSS liability for card brand assessments, costs to identify and remove the malicious code, breach notification obligations to affected customers, and potential liability claims from card holders whose details were stolen.

DDoS Attacks: Taking Your Store Offline

Distributed denial of service (DDoS) attacks overwhelm your website with fake traffic, making it inaccessible to genuine customers. For eCommerce businesses, a DDoS attack during peak trading periods — Christmas, Black Friday, or during a major promotional campaign — can result in thousands of dollars per hour in lost sales. Competitors and extortionists sometimes use DDoS attacks strategically to cause maximum business disruption.

PCI-DSS Compliance and Cyber Insurance

Any business that processes, stores or transmits payment card data must comply with the Payment Card Industry Data Security Standard (PCI-DSS). A breach that exposes card data triggers a mandatory PCI forensic investigation, potential card brand fines and assessments, and the cost of card replacement for affected customers. Cyber insurance specifically addresses PCI-DSS liability, covering these fines and assessment costs where they are insurable.

Point-of-Sale System Attacks

Physical retail businesses face additional threats from point-of-sale (POS) system compromises. Malware installed on EFTPOS terminals can capture card data in real time across multiple locations simultaneously. NZ Police and CERT NZ have reported increasing incidents of POS malware, particularly targeting hospitality and retail businesses that use networked EFTPOS systems.

Retail Cyber Insurance Coverage

A comprehensive retail cyber insurance policy covers: customer data breach response and notification, PCI-DSS liability and card brand fines, business interruption losses during website downtime, DDoS attack response, website restoration and code forensics, third-party claims from customers, and supply chain or third-party platform breach costs. Given the interconnected nature of retail systems — payment processors, fulfilment platforms, marketing tools — ensuring your policy addresses third-party and supply chain risk is particularly important.