Security experts have warned of potential disruption to the upcoming holiday shopping season after recording a double-digit year-on-year increase in bot-driven cyber-attacks so far in 2021.

Imperva’s State of Security Within eCommerce report revealed that over half (57%) of attacks targeting retail websites this year were carried out by bots, versus just 33% across other industries.

Account takeover attempts, looking to hijack customers’ accounts to steal personal and financial info, reached 33% so far in 2021, versus 26% across other verticals.

These attacks are often carried out by what Imperva describes as “sophisticated” bots, capable of mimicking human mouse movements and clicks to defeat retailers’ cyber-defenses.

They’re responsible for account takeover and denial of inventory, where items are added to account baskets to take them out of circulation, making them unavailable for legitimate customers.

This could exacerbate existing supply chain issues that threaten stock availability this holiday season, warned Imperva director of technology, Peter Klimek.

“With the global supply chain conditions worsening, retailers will not only struggle to get products to sell in Q4 but will face increased attacks from motivated cyber-criminals who want to benefit from the chaos,” he argued.

“Imperva Research Labs’ data underscores the need for retailers to invest in security that spans from edge to applications and APIs all the way to the data. Only by protecting all paths to data can retailers truly defend their critical systems and the consumers who rely on them.”

To that end, Imperva also recorded a surge in DDoS attacks, including a 200% month-on-month increase in September 2021.

The vendor warned that as retailers build out their website functionality with chatbots and web analytics and connect customers via API to features such as product search and order fulfillment tracking, their cyber-attack surface will continue to expand.

Over 20 staffers at the Student Loans Company (SLC) have faced disciplinary action for computer misuse and other offenses, including three former employees who were fired, according to new Freedom of Information (FoI) data.

Litigation firm Griffin Law revealed the findings of its FoI requests to the non-profit, which is owned by the UK government’s Department for Education and is responsible for administering loans and grants to students.

While several of the 23 offenses related to excessive internet use during work time, one of which resulted in dismissal, several involved the culprits accessing the accounts of friends and family members.

That resulted in one dismissal in 2019, and this year one individual on a final written warning and another suspended pending an investigation.

Many of the other offenses related to inappropriate use of social media or the sharing of inappropriate content via email.

Several offenders used offensive or aggressive language targeting colleagues on Facebook, while one was fired in 2018 after sharing content on the social network linking a colleague to criminal activity. That was judged to have potentially brought the SLC into disrepute.

On one occasion in 2020, a former SLC employee was sacked after sharing inappropriate and offensive material on Microsoft Teams, according to Griffin Law.

An SLC spokesperson got in touch with Infosecurity seeking to put the findings into context.

“At SLC we have robust policies and procedures in place to ensure that colleagues use technology appropriately, to identify instances of unacceptable behaviour and to take action when required,” they said in a statement. “We employ over 3000 colleagues and as the data rightly demonstrates there have been very few instances over the past four years where action was required.”  

Torsten George, a cyber evangelist at Absolute Software, argued that the FoI data highlights the risk of malicious insiders accessing and potentially stealing sensitive customer information.

“The risk of SLC employees walking away with sensitive data or selling their access credentials has never been greater now that a record number of individuals have been made redundant and face financial hardship due to COVID-19,” he added.

“All too often, large organizations like the SLC are aware of the challenges related to external threat actors, and they, therefore, focus their efforts on creating deterrents to protect against these cyberattacks. In doing so, they often overlook the fact that the biggest threats can arise from within.”

The UK’s data protection and privacy regulator is getting worse at collecting the fines it hands out to penalize erring companies, according to new data from TheSMSWorks.

The SMS API provider has been tracking the progress of the Information Commissioner’s Office (ICO) in such matters since 2018.

Unfortunately, it revealed that just a quarter (26%) of the monetary value of fines it issued from January 2020 to September 2021 had been paid, down from 32% during the last report period (January 2019-August 2020).

That means, out of the 47 individual fines during the current period, amounting to £7m, just 19 had been successfully collected, at a value of only £1.8m.

This excludes the sizeable GDPR penalties for British Airways (£20m) and Marriott International (£18.4m). These companies have reportedly agreed to pay their fines in annual installments.

The news comes despite legislation that effectively makes company directors responsible for paying fines. In the past, many would declare bankruptcy to avoid the fine.

According to TheSMSWorks, many directors simply refuse to pay or initiate a slow and unwieldy appeals process. It claimed that Eldon Insurance, fined £60,000 for email spam in February 2019, still has an unresolved appeal being processed.

Another company, MyIML Ltd, has reportedly not yet fully paid its £80,000 nuisance call fine six years after it was issued.

Over £1m in unpaid fines are said to be currently under appeal.

Henry Cazalet, director of TheSMSWorks, said awareness of the issue often falls under the radar.

“People reasonably assume that if an organization has been fined then it will be paid and the taxpayer will benefit,” he told Infosecurity.

“I think The ICO’s reputation could take a bit of a hit, particularly as it has over 500 members of staff now.”

Cazalet said he had some sympathy with the regulator, which must balance the twin goals of discouraging shady practices and collecting fines effectively.

“However, I believe that the fining policy is just too aggressive,” he concluded. “It makes a great headline to state that you’re fining a rogue organization for a huge sum, but if you can’t collect it, then it’s ultimately just posturing.”

Fines for SMS spam are the most likely to remain unpaid, with 82% of penalties yet to be collected, the report noted.