Illustration: a scan film, in point clouds, of the places a retailer runs: a shopping street at night, a supermarket aisle after closing with its chilled cases, the checkouts and their card terminals, the self-checkouts, a web shop checkout on a laptop at home, a distribution centre’s dispatch floor and the Cantic mark. The labels show synthetic readings and addresses.
SupermarketsStore chainsOnline shops
We break into your shops before a criminal does.
From your web shop to customer accounts, payments and store systems. With Fortify, we write the fix within 24 hours.
Real attack Supermarkets across Europe See the attacks
Retail and e-commerce
A criminal needs only one way into your shops.
Every line to the internet is a door.
Eclipse, our own model trained to attack, keeps going until it can prove full control.
In plain words: an attacker that works for your company.
How far Eclipse goes
- Website
- Apps
- Logins
- Cloud
- Servers
- Internal network
- Machines
What your business runs on
We know what a retailer runs on. So do criminals.
Outside firms
- Your IT provider
- Till and card terminal provider
- E-commerce agency
- Refrigeration contractor
- Building services contractor
Remote access
- VPN
- Remote desktop
- Remote support
- Vendor portals
- 4G routers
-
Web shop
- Website and checkout
- Customer accounts
- Loyalty app
- Admin panel
-
Stores
- Tills and self-checkouts
- Card terminals
- Electronic shelf labels
- Customer Wi-Fi
-
Plant room
- Refrigeration supervisor
- Heating and air conditioning
- Building management
-
Warehouse and office
- Warehouse system
- Supplier orders (EDI)
- ERP
- Backups
-
Nine European countries
Supermarkets across Europe
Store refrigeration taken over remotely and switched to defrost; chilled and frozen food thrown away.
Sources France 24 (AFP) CNBC (Reuters) NBC News Euronews Infobae
-
France
Supermarkets across France
Fridges driven up to 50 °C; about 700 of 10,000 supermarkets affected, the minister said.
Sources Click2Houston (AP) France 24 (AFP) ABC News (Australia) Techniques de l’Ingénieur (AFP) Public Sénat CERT‑FR (ANSSI) INCIBE‑CERT
-
Netherlands, Belgium and the United States
Ahold Delhaize, owner of Albert Heijn and Delhaize
Albert Heijn’s online deliveries and apps went down; it blamed “malicious actions of others”. No link to France has been shown.
Sources NOS The Register
Compared
This is not a yearly pentest.
| A normal pentest | Cantic |
|---|---|
| Once a year | Day and night, and on every change |
| A PDF weeks later | Proof as it happens, with a replay |
| Stops at the website | From the website to the server and the machine |
| You work out the fix | We write the fix within 24 hours |
| You hope it holds | We attack again to check it holds |
Under your control
Inside the rules you sign.
Guardrails and data privacy for retailers and their customers.
Nothing runs until you sign
An authorisation and rules of engagement, signed by someone entitled to authorise the test.
Inside the limits you set
Your scope, hours and limits. It stops once it can prove control.
Stop it within 60 seconds
Rate-limited and time-boxed, so your systems do not slow down.
Every action on the record
Hashed and timestamped in a ledger you can inspect, and followed live.
A person on every critical finding
A named lead on our team.
No outside AI company sees your data
Eclipse is our own model, on our own servers.
Destroyed when the work is done
Deleted in several steps on our side; we do not keep it. First test reports: 14 days unless you subscribe.
Your IT provider gets the fix
Findings and fixes go to your own team or your IT provider.
Regulation
The rules a retailer answers to.
- PCI DSS asks for penetration tests at least every 12 months and after any significant change (11.4.2 to 11.4.4). 1
- Every script on your payment pages must be authorised and checked, with alerts on unauthorised changes (6.4.3 and 11.6.1). 1
- Multi-factor authentication on remote access to card data, and outside firms’ accounts enabled only when needed (8.4.3, 8.2.7). 1
Questions
What buyers ask us
- What would you test?
- Your web shop, checkout, customer accounts, apps, email, VPNs and contractors’ logins, from the outside.
- Does it help with PCI DSS?
- Yes: with Fortify we test after every change and keep retest evidence, but we do not certify compliance.
- We already have an IT provider. Why you?
- Your IT provider runs your systems and we attack them; if they already handle security, we find what they missed.
How it starts
Your results in one day.
You sign the rules
An authorisation and rules of engagement, signed before anything runs.
Eclipse tests what is in scope
From the outside, the way an attacker would. There is nothing to install.
We put the findings on the table
In plain words, with what to do. Every finding comes with proof.
Sources
- PCI Security Standards Council, Middlebury College, Payment Card Industry Data Security Standard: Requirements and Testing Procedures, Version 4.0.1, . Read on .
- US Senate Committee on Commerce, Science, and Transportation (GovInfo), Protecting Personal Consumer Information from Cyber Attacks and Data Breaches (S. Hrg. 113-531), . Read on .