Retailers have long been in the crosshairs of hackers. They are attractive targets because they have an abundance of consumer data, limited resources to defend against sophisticated attacks, and their networks span hundreds of locations. In other words, rich pickings for cybercriminals.
The mega breaches in the US against retailers HomeDepot and Target in 2013 were early warnings of what was in store for the UK. More than a decade on, UK retailers are now in the firing line, and cybercrime has become a global service economy. Crime gangs such as DragonForce and Scattered Spider are creating marketplaces for ransomware-as-service and other models, and advances in AI now make it far easier to produce malware and conduct phishing attacks.
Recent cyberattacks such as the M&S breach, which exposed the personal data of thousands of customers, and the Co-op breach where all 6.5 million of its members had their data stolen, highlight the limits of consumer protection. Unless a consumer can directly link a scam, fraud, or financial loss to an organisation, it is unlikely that the organisation will consider a claim.
The hidden dangers for consumers
When a business is breached, the focus is on lost sales, disrupted services, and reputational damage. Firms have learnt to treat data issues carefully, not over-notifying but reporting according to the law and what is best for their reputation. However, the impact on consumers is often deeper and more enduring. Hackers may have accessed personal customer data, including names, birth dates, addresses, and order histories.
The breached firm will notify in line with the UK Data Protection Act 2018 and offer credit monitoring to those impacted. But unless customers suffer financial loss, the organisation will assume very little responsibility. The information held by hackers and shared on the dark web can be used for identity theft, targeted scams, and social engineering attacks long after the initial incident.
Personal data (other than card data which has a limited shelf life) stolen in mass cyberattacks often circulates in criminal networks for months and sometimes years. Victims may not immediately realise they are at risk, and the consequences (fraudulent credit applications, phishing attempts, and financial scams) can take time to materialise.
Current protections are not enough for consumers
Most corporate cyber insurance policies are designed to protect the business, not the consumer. After a major breach, affected customers are typically offered credit monitoring services. This is a reactive step that does little to prevent or mitigate the damage from stolen personal data. Direct losses suffered by consumers, such as identity theft, online fraud, or the costs of restoring a digital reputation, must directly relate to the event, and there is no easy recourse for consumers. In short, as the Americans would say, the consumer is ‘left holding the buck’.
Prioritising consumer-focused cyber protection
Governments must rethink consumer protection. In an era when digital trust is paramount, firms that provide services to consumers and hold their data should contribute to a National Personal Cyber Insurance Scheme. This would give consumers access to a national hotline to resolve incidents along with direct protection to cover financial losses. It would help raise awareness of cyber issues, build consumer trust, and incentivise consumers to proactively respond to cyber threats.
A national scheme would prevent overlapping insurance policies and double insurance, avoiding the need for firms to embed personal cyber protection into loyalty programmes or premium memberships. At present, some consumers will have credit monitoring provided at the same time by multiple firms, highlighting the inefficiency of current practice.
Digital health – the need for collaboration
Collaboration is the key for a national, government-backed, industry-led personal cyber insurance scheme. The UK government can provide regulatory clarity, financial backing, and public trust, while the insurance industry would bring innovation, risk assessment expertise, and scalable infrastructure.
A collaborative framework can be built that is accessible, affordable, and responsive to evolving threats. Public awareness campaigns, cross-sector working groups, and pilot programmes can lay the groundwork, ensuring the scheme not only protects individuals but also strengthens national resilience.
The cyber threat landscape is changing and protection must increase in response. We need the equivalent of the UK’s National Insurance contributions and National Health Service to protect consumers against growing digital threats. By creating a National Personal Cyber Insurance Scheme, the UK can raise awareness of cybercrime through a small taxation on consumer-facing organisations and partner with the insurance industry in a similar way that PoolRe and FloodRe provides protection against systemic risks. The result: stronger citizen security and a more resilient population.