Retail has become cybercrime’s favourite playground. From Target’s catastrophic 2013 breach to British Airways’ record GDPR fine, the past decade has been a brutal education in digital vulnerability. Yet, as this April’s M&S incident proves, many still haven’t learned their lesson.