What: Retailers face a new cybersecurity threat as AI systems become vulnerable to manipulation through hidden prompts, potentially compromising product recommendations, customer service, and operational decisions.

Why it is important: With ransomware now accounting for 30% of retail security incidents and average losses reaching £1.4 million per attack, this new threat vector through AI systems represents a critical vulnerability that could amplify existing security risks.

The integration of AI tools into retail workflows has created an unexpected vulnerability: prompt injection attacks. While these AI systems efficiently handle tasks from customer service to inventory management, they also present a new attack surface that doesn't require traditional hacking methods. Through carefully crafted text or metadata, malicious actors can manipulate AI models to override policies, distort analysis, and compromise decision-making processes. The threat is particularly insidious because it exploits what makes AI powerful - its training to follow instructions - while leaving no obvious intrusion points.

The risk extends across multiple retail touchpoints, from marketplace platforms using AI for product listings to chatbots handling customer requests. Unlike conventional cyber attacks, prompt injections can create falsified summaries, manipulated product comparisons, and distorted personalised promotions without triggering security alerts. This creates a diagnostic challenge for retailers, as tracing the source of manipulated outputs becomes increasingly complex in an environment where data flows from numerous sources simultaneously.

The retail sector's vulnerability is heightened by its fragmented architecture and real-time data processing requirements. Forward-thinking retailers must now approach AI not just as a tool for efficiency but as a critical security concern requiring robust governance, clear data lineage, and sophisticated monitoring systems.

IADS Notes: Recent cyber incidents underscore the urgency of addressing AI vulnerabilities in retail. The April 2025 attack on Marks & Spencer that wiped £700 million off their market value demonstrates the severe financial implications of security breaches. This is particularly concerning given that 82% of companies lack strong digital core security maturity, while 86% use third-party tools but only 13% fully understand their data collection practices. The March 2025 incident resulting in £5.4 billion in losses across Fortune 500 companies further highlights how quickly security vulnerabilities can escalate in today's interconnected retail systems.

Retail’s next tech breach won’t be a hack