--- title: "Retail Sector: How a Silent Open Source Risk Cost HighStreetCom" description: A case study of one of the retail sector's high street chains describes how an invisible software supply chain dependency disabled their loyalty system. image: https://beatopensourcevulns.meterian.io/hubfs/Meterian_Image_LR_V01.jpg --- [![](https://alpha.meterian.io/images/brand/meterian_logo_blue.svg)](https://beatopensourcevulns.meterian.io/?hsLang=en) - Products - [Meterian Open Source Security Management](https://www.meterian.io/product/meterian-X-open-source-vulnerability-platform/) - [Meterian Licence Compliance Management](https://www.meterian.io/product/open-source-licence-compliance/) - [Pricing](https://beatopensourcevulns.meterian.io/plans/?hsLang=en) - Docs - [Integrations](https://www.meterian.io/integrations.html) - [CLI](https://docs.meterian.io/the-client/client) - [API](https://www.meterian.io/documentation/swagger-ui.html) - [About](https://www.meterian.io/about/) [Sign In](https://www.meterian.io/dashboard) [Book a demo](https://meetings.hubspot.com/vivian21) [![](https://alpha.meterian.io/images/brand/meterian_logo_blue.svg)](https://beatopensourcevulns.meterian.io/?hsLang=en) - Products - [Meterian Open Source Security Management](https://www.meterian.io/product/meterian-X-open-source-vulnerability-platform/) - [Meterian Licence Compliance Management](https://www.meterian.io/product/open-source-licence-compliance/) - [Pricing](https://beatopensourcevulns.meterian.io/plans/?hsLang=en) - Docs - [Integrations](https://www.meterian.io/integrations.html) - [CLI](https://docs.meterian.io/the-client/client) - [API](https://www.meterian.io/documentation/swagger-ui.html) - [About](https://www.meterian.io/about/) [Sign In](https://www.meterian.io/dashboard) [Book a demo](https://meetings.hubspot.com/vivian21) ![Retail Sector](https://beatopensourcevulns.meterian.io/hs-fs/hubfs/chuttersnap-9cCeS9Sg6nU-unsplash.jpg?width=2000&height=1333&name=chuttersnap-9cCeS9Sg6nU-unsplash.jpg "Retail Sector") CASE STUDY How a Silent Open Source Risk Cost HighStreetCom £2.7 Million [![Frame-4](https://beatopensourcevulns.meterian.io/hs-fs/hubfs/Frame-4.png?width=171&height=50&name=Frame-4.png "Frame-4")](https://www.easyfundraising.org.uk/) An undetected vulnerability in a common open-source library led to one of the UK’s most trusted retail brands facing customer data breaches, regulatory fines, and operational disruption. HighStreet.com’s Loyalty Rewards Platform relied on software built by third-party vendors. Those vendors used the open-source library jackson-databind, which later revealed a critical RCE (Remote Code Execution) vulnerability. With no SBOM (Software Bill of Materials) and no early warning system in place, the vulnerability went unnoticed until attackers exfiltrated 90 GB of customer data. In short, an invisible dependency brought the whole loyalty system down. ## Root Cause and Missed Signals - No SBOMs from third-party vendors - Public-facing API endpoints exposed vulnerable code - Contracts lacked open source vulnerability SLAs - HighStreetCom's vulnerability scanning skipped vendor binaries - No real-time threat intelligence to catch exploitation attempts > #### Meterian's continuous open-source vulnerability monitoring and automated remediation could have flagged the use of the vulnerable jackson-databind library and reduced the blast radius drastically. ## What HighStreetCom Did Next - Enforced SBOM requirements for all vendors - Updated contracts to mandate vulnerability disclosures within 7 days - Integrated Meterian-style software composition analysis (SCA) tools to assess vendor-supplied code - Launched open-source vulnerability training for PR, legal, and cyber teams > #### If your organisation integrates software from third parties, you are part of a software supply chain. And without open-source security scanning, you’re operating blind. ## Get the Full Story ##### Understand exactly how the attack unfolded, what warning signs were missed, and what recovery actions were taken READ THE STORY ##### Or [schedule a demo](https://meetings.hubspot.com/rod-cobain1) to see how Meterian can help you mitigate risks in your software supply chain. [![Share on facebook](https://7528309.fs1.hubspotusercontent-na1.net/hub/7528309/hubfs/raw_assets/public/mV0_d-web-default-modules_hubspot/img/facebook-color.png?width=24&name=facebook-color.png)](https://www.facebook.com/share.php?u=https%3A%2F%2Fbeatopensourcevulns.meterian.io%2Fsuccess-stories%2Fretail-sector-how-a-silent-open-source-risk-cost-highstreetcom%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://7528302.fs1.hubspotusercontent-na1.net/hub/7528302/hubfs/raw_assets/public/mV0_d-web-default-modules_hubspot/img/linkedin-color.png?width=24&name=linkedin-color.png)](http://www.linkedin.com/shareArticle?mini=true&url=https://beatopensourcevulns.meterian.io/success-stories/retail-sector-how-a-silent-open-source-risk-cost-highstreetcom?utm_medium=social&utm_source=linkedin&text=Read%20about%20how%20an%20undetected%20vulnerability%20in%20a%20common%20open-source%20library%20could%20lead%20to%20one%20of%20the%20UK’s%20most%20trusted%20retail%20brands%20facing%20customer%20data%20breaches,%20regulatory%20fines,%20and%20operational%20disruption%20#dataprotection%20#cybersecurity) [![Share on twitter](https://7528304.fs1.hubspotusercontent-na1.net/hub/7528304/hubfs/raw_assets/public/mV0_d-web-default-modules_hubspot/img/twitter-color.png?width=24&name=twitter-color.png)](https://twitter.com/intent/tweet?original_referer=https://beatopensourcevulns.meterian.io/success-stories/retail-sector-how-a-silent-open-source-risk-cost-highstreetcom?utm_medium=social&utm_source=twitter&url=https://beatopensourcevulns.meterian.io/success-stories/retail-sector-how-a-silent-open-source-risk-cost-highstreetcom?utm_medium=social&utm_source=twitter&source=tweetbutton&text=Read%20about%20how%20an%20undetected%20vulnerability%20in%20a%20common%20open-source%20library%20could%20lead%20to%20one%20of%20the%20UK’s%20most%20trusted%20retail%20brands%20facing%20customer%20data%20breaches,%20regulatory%20fines,%20and%20operational%20disruption%20#dataprotection%20#cybersecurity) [![Share on email](https://7528311.fs1.hubspotusercontent-na1.net/hub/7528311/hubfs/raw_assets/public/mV0_d-web-default-modules_hubspot/img/email-color.png?width=24&name=email-color.png)](mailto:?subject=Check%20out%20https://beatopensourcevulns.meterian.io/success-stories/retail-sector-how-a-silent-open-source-risk-cost-highstreetcom?utm_medium=social&utm_source=email&body=Here's%20a%20case%20study%20on%20the%20Retail%20Sector.%20%20A%20high%20street%20retailer%20suffers%20from%20an%20undetected%20vulnerability%20in%20a%20common%20open-source%20library%20which%20could%20lead%20to%20one%20of%20the%20UK’s%20most%20trusted%20retail%20brands%20facing%20customer%20data%20breaches,%20regulatory%20fines,%20and%20operational%20disruption.%20%20Learn%20how%20Meterian%20helps%20avoidance%20of%20known%20vulns%20and%20reinforces%20the%20software%20supply%20chain.%20%20https://beatopensourcevulns.meterian.io/success-stories/retail-sector-how-a-silent-open-source-risk-cost-highstreetcom?utm_medium=social&utm_source=email) [![Frame 3](https://beatopensourcevulns.meterian.io/hubfs/Frame%203.svg "Frame 3")](https://www.easyfundraising.org.uk/) - Location: United Kingdom - Industry: Retail – National High Street Chain - Employees: 10,000+ - Revenue: £3.2 billion annually - Incident: Remote Code Execution (RCE) via open-source dependency - Impact: £2.7M in losses, 1.3M customers affected - Solution: Software supply chain visibility, SBOMs, continuous monitoring --- ![Man_Account_V02](https://beatopensourcevulns.meterian.io/hubfs/Landing_Pages/LP-icons/Man_Account_V02.png "Man_Account_V02") **CISO** of HighStreetCom “We weren’t caught off-guard because of a lack of tools, but because no one was looking inside the vendor black box. Open source risks don’t stop at your codebase. They travel with every partner you integrate.”  --- READ THE STORY [![BOOK A DEMO](https://no-cache.hubspot.com/cta/default/4992692/a70039b1-f455-4ba3-9dd3-ac6a97c950a0.png)](https://cta-redirect.hubspot.com/cta/redirect/4992692/a70039b1-f455-4ba3-9dd3-ac6a97c950a0) ![Meterian Shield with Ship it flag](https://www.meterian.io/images/footer/shipit_w_flag.png) # Ready to get started? ## Meterian de-risks apps continuously [book a demo   >](https://meetings.hubspot.com/vivian21) [login](https://www.meterian.io/dashboard) **PRODUCTS** [Meterian-X Open Source Security Management](https://www.meterian.io/product/meterian-X-open-source-vulnerability-platform/) [Meterian Licence Compliance Management](https://www.meterian.io/product/open-source-licence-compliance/) **COMPANY** [About](https://www.meterian.io/about) [Careers](https://www.meterian.io/about/#careers) [Blog](https://blog.meterian.com) [Terms](https://www.meterian.io/terms.html) [Privacy Policy](https://www.meterian.io/gdpr.html) **RESOURCES** [My Account](https://www.meterian.io/dashboard) [Documentation](https://docs.meterian.io) [Meterian API](https://www.meterian.io/documentation/swagger-ui.html) [FAQ](https://www.meterian.io/plans/#faq) ![Meterian](https://www.meterian.io/images/brand/meterian_logo_white.svg) Meterian boosts the security, stability and compliance of software applications so teams can ship software without vulnerabilities ASAP. Meterian empowers enterprises to proactively manage their software assets with the teams they have, regardless of where they are in their digital transformation journey. - - - Let's chat! [hello@meterian.io](mailto:hello@meterian.io) © 2017-2021 Meterian Ltd |  Registered in England and Wales Company Number: 11439878 |  Registered address: 196 Freston Road, London, London, United Kingdom, W10 6TT