Black Friday cybersecurity: What Scottish businesses need to know
Black Friday is the busiest shopping day of the year. It’s also one of the busiest days on a cyber criminal’s calendar. Here’s what Scottish businesses need to know before the rush hits.
Black Friday is the single biggest trading day of the year for most retailers. It is also one of the busiest periods for cyber criminals. When shoppers are moving fast, clicking quickly and expecting deals in their inbox, the conditions are close to perfect for phishing, fraud and account takeovers.
At m3 Networks, we work with businesses across Scotland to help them stay secure. Every year around this time we see the same patterns play out. This post covers what the data shows, what the big incidents looked like, and what Scottish business owners can actually do about it before the rush hits.
The Cyber Security Stats That Should Make You Stop and Think
The numbers from recent Black Friday periods are worth paying attention to.
During Black Friday week in 2024, phishing attacks jumped 692% compared to the start of November. That is nearly seven times more attempts in a matter of days.
Research by Check Point found that 1 in 11 newly registered Black Friday-themed domains were classified as harmful. These are not random spam sites. They are purpose-built pages designed to look like genuine retailers, courier tracking portals and promotional offers.
Kaspersky blocked more than 198,000 Black Friday-themed spam messages in just the first two weeks of November 2024. Bot attacks on retail websites were up 50% over the monthly average. Consumers spent around
The volume of money moving and the urgency people feel creates an environment where people are more likely to click first and question later. Attackers know that and plan around it.
When the Big Brands Got Hit
It is easy to assume that cyber incidents are an enterprise problem. The breaches that make the news often involve household names. But the tactics behind those incidents are the same ones used against much smaller businesses every week.
Target (2013)
Attackers compromised over 40 million customer payment cards across a three-week Black Friday window. The entry point was not a sophisticated zero-day attack. It was stolen login credentials from a third-party supplier. The total cost to Target reached 02 million, with an
TJX / TK Maxx (2005 to 2007)
Weak wireless security gave attackers access to the network for years before anyone noticed. By the time the breach came to light, an estimated 45.7 million credit and debit card details had been taken from UK and US operations. Staff found unfamiliar software on the servers and that was the first sign something had gone wrong.
Macy's (2019)
A Magecart attack placed malicious code directly on the checkout page and quietly harvested card details, expiry dates and security codes from thousands of customers before it was detected.
What these incidents have in common is that the attackers were patient, and the businesses were busy. A high-volume trading period is exactly when security monitoring drops down the priority list.
Why Cyber Security for Small Business Is Not Optional
The phrase we hear most often from Scottish SME owners is some version of: "we are too small to be worth targeting." - and we understand why people think that, but it is the wrong way to look at it.
Smaller businesses are attractive precisely because they are less likely to have dedicated security resource, up-to-date software, or a plan for what happens when something goes wrong. Attackers do not need the biggest target. They need the easiest one.
Research found that only 28% of small business owners had any kind of cyber attack plan in place. That leaves the majority of SMEs with no clear idea of what they would do if something went wrong today.
We see the effects of that across Scotland, in Perth, Edinburgh, Glasgow and beyond. The businesses that get caught out are rarely targeted because of who they are. They are caught out because a vulnerability was there and nobody had got round to fixing it.
The Four Cyber Threats We See Most in Scottish SMEs
Based on what we deal with at m3, these are the threats most active during the Black Friday and Christmas period.
Phishing and business email compromise
Emails that look like they are from a supplier, courier or colleague but are not. During the shopping season these are harder to spot because everyone is already receiving a high volume of legitimate promotional emails. One click on the wrong link can give an attacker a foothold in your network.
Ransomware
Attackers encrypt your files and demand payment to restore access. A busy trading period is the ideal time to strike. The pressure to get back up and running quickly makes businesses more likely to pay without thinking it through.
Credential stuffing and account takeovers
Attackers take username and password combinations from old data breaches and test them across other platforms. If your team reuses passwords across accounts, this is a real exposure. We see it regularly.
Card and payment fraud
For any business taking payments online, higher transaction volumes mean more opportunity for attackers to look for weaknesses in the checkout process. Magecart-style attacks specifically target that window.
How Shoppers Can Stay Safe This Black Friday
Data security is not just a business concern. As a shopper you are a target too, and the same Black Friday urgency that catches businesses out catches individuals out as well.
- Check the URL before you click. Fake retail sites often use misspellings or slight variations on a well-known domain. Look for HTTPS and take a second to read the address.
- Be suspicious of deals that look too good. If a price is dramatically lower than everywhere else, that is worth questioning.
- Use a credit card rather than a debit card. Credit cards generally give you stronger protection if something goes wrong.
- Avoid shopping on public Wi-Fi. If you have to use a public network, a VPN will give you some protection.
- Watch out for fake delivery texts. "Your parcel is on hold, click here to rebook" is one of the most common phishing traps running through November and December.
- Use a different password for each account. A password manager makes this straightforward to manage.
Managed Cyber Security Services for Scottish Business Owners: Six Things to Do Before the Rush
If your business handles customer data, takes online payments, or relies on email to operate, here is where to focus your attention before Black Friday.
1. Get your software up to date now
Outdated software is one of the most common entry points we see. Windows updates that have been sitting pending, plugins that have not been patched in months, antivirus definitions that are out of date. Each one is a potential way in. This is not something to leave until the new year.
2. Switch on multi-factor authentication
MFA means that even if a password is stolen, an attacker cannot get straight in. It is one of the simplest and most effective things you can do. Most business applications have it built in and it takes a short time to set up across your team.
3. Brief your team on phishing before the season starts
Your staff are the first line of defence. A short session before Black Friday on what to look out for in suspicious emails can make a significant difference. This is something we include as part of our managed cyber security services because training needs to be ongoing, not a one-off.
4. Test your backups
Having a backup is not the same as having a working backup. If ransomware hits, the difference between a short disruption and a serious one is whether you can actually restore from your backup. When did you last test that?
5. Look at Cyber Essentials certification for your Scottish business
Cyber Essentials is a UK government-backed certification that sets out the basic controls businesses should have in place. For Scottish businesses looking at public sector contracts, it is often required. For everyone else, it gives you a clear baseline to work from. At m3 Networks we guide businesses through the full Cyber Essentials process. Find out more at m3networks.co.uk/cyber-essentials.
6. Get proper security support in place
Most Scottish SMEs do not have a dedicated IT security person in-house, and they should not need one. Managed cyber security services mean you have a team monitoring your systems and responding to threats as part of your day-to-day operations, without needing to recruit for a role that most small businesses cannot justify.
The Bottom Line
Black Friday is good for business. It is also the period when cyber criminals are most active, most prepared and most likely to find a gap in a business that has been too busy to close it.
The businesses that come through November and December without an incident are not necessarily the ones with the biggest budgets. They are the ones that did the basics properly before the rush started.
If you are not sure where your business stands on cyber security, or you want to talk through what managed cyber security services would look like for your organisation, get in touch with the team at m3 Networks. We work with businesses across Perth and Scotland and we are happy to take a look at your current setup.
m3 Networks provides managed cyber security services for businesses across Perth and Scotland. Get in touch to find out how we can help.