Quarterly retail review Q4 2021

In Q4, traditionally the busiest time of year for retailers and shoppers, investors and trade buyers were on a spree of their own, acquiring 19 UK-based retail companies. This took the total volume of UK retail and consumer deals in 2021 to 65, the joint second-highest figure since 2015.

Figure 1: UK Retail M&A  Volume/Value chart

Disclosed deal value for 2021 returned to pre-COVID-19 levels, up at £13.5 billion, compared to £7.9 billion in 2020. This reflects that deal activity all but ceased in the early days of coronavirus but returned in force in 2021.

A boost for bricks and mortar

Deep in the pandemic, there was a knee-jerk reaction among some to declare "the end of bricks and mortar". However, Q4 2021 has shown a recalibration of this to a more balanced approach, which values the importance of physical store presence within a strong omnichannel offering. Furniture retailer Loaf, which was acquired by Blue Coast Capital in November following Vendor Due Diligence performed by us, is a good example of such a business: its strong internet offer is supported by eight shacks across the UK.

Early in the quarter, before Omicron took hold and 'Plan B' was implemented in England, retail footfall was improving (though still not as strong as pre-pandemic levels), according to data from Springboard. Confidence in traditional retailing was also demonstrated by the Weston family’s December sale of Selfridges Group to Thai retailer Signa and Australian property group Central for a reported £4 billion.

Post-lockdown consumer habits continue to drive deals

Not only has COVID-19 altered the way we shop, but also how we live. In Q4, buyers continued to seek deals that capitalise on post-pandemic consumer trends:

Health and fitness – lockdowns drove many Britons to the great outdoors, including rivers, lakes, and seas. This inspired the sale of two inflatable stand up paddleboard brands: Red Paddle to Myers Family Office (another deal we advised on); and HIKS to Profound Commerce.  Back on dry land, JD Sports acquired a majority stake in Wheelbase Lakeland Limited, which has three bike stores in the North of England.

Demand for home delivery – hybrid working has driven demand for doorstep delivery. In November, Turkish grocery delivery company Getir acquired Weezy, a UK grocery service that claims to deliver ‘products in minutes’. In December, we advised on the Series D fundraising of HungryPanda, an online delivery platform specialising in Asian cuisine.  

Restructuring and recovery

In December, contemporary fashion house self-portrait acquired the luxury brand Roland Mouret from administration (Grant Thornton acted as administrators).

This was the only disclosed restructuring and recovery retail deal in Q4. This low number is no doubt due to government interventions, such as business rate cuts and the furlough scheme. In a boost for the industry, we believe measures such as these have given some retailers the breathing space to improve their online operations and exit the pandemic stronger than before.

Overseas interest

Figure 2: Deals by acquiror domicile

Seven of the 19 deals in Q4 involved overseas buyers, showing that the UK is still viewed as a strategic entry point to mainland Europe (despite Brexit) as well as a strong market in its own right.

Looking forward: private equity and valuations in 2022

Figure 3: private equity involvement in retail deals 2010-2021

One of the biggest trends over 2021 was the proliferation of private equity (PE) into the retail M&A mix, particularly in deals involving eCommerce.

PE’s keenness on the sector and record amounts of dry powder have the potential to drive up valuations and price trade buyers out of the market. However, a softening of the performance of the retail sector in capital markets throughout 2021 may be enough to temper growing multiples. As we progress through 2022, we expect to see more realistic valuation expectations on both sides of the table.

For more insight and guidance on retail M&A in Q4 2021 get in touch with Nicola Sartori.

The retail sector has been under immense pressure over the past 18 months, with front lines battered by successive lockdowns shuttering stores across UK high streets. This is now being compounded by major supply chain issues and staff shortages as businesses strive to return to normal trading patterns.

To add more difficulties to an already tough situation, cyber security threat actors have been maliciously targeting the retail sector.

Severe disruption to business

An independent report from Keeper Security found that successful cyber attacks against retailers resulted in severe disruptions to:

These results are reflected in numerous other industry reports which indicate that retail was one of the two most attacked industry sectors in 2019 and fourth most attacked in 2020.

Requirements of online retail makes sector vulnerable

Unfortunately, the long term risks for retail look set to have increased in 2021, with the huge consumer-driven shift to eCommerce during coronavirus, where simply implementing more cyber security solutions is not straightforward. In order to compete and encourage consumer spending, online retail requires user-friendly interfaces, a pleasurable shopping experience and ease of purchase. Consumers may see more robust cyber security measures as a complicating factor that makes the process less pleasurable.

In 2020 management consultants Oliver Wyman identified a reluctance by online retailers to implement best-practice cyber security steps, such as two-stage purchase verification, fearing it might lead to shoppers abandoning their purchases if they felt it was too difficult or time-consuming. More sophisticated hackers are likely to see such reluctance as an invitation to target retailers whose security is weaker or lags behind best practice.

Types of retail cyber attacks

The industry is reporting more targeted attacks specific to the retail industry. For example, the Oliver Wyman report identifies an increasing number of scams in the following areas:

• mobile in-store payments – using hacked customer login credentials to shop in-store using retailers’ own mobile apps
• add new payment – hacking into existing accounts with a good purchasing history and adding stolen credit card information as a new means of purchase
• return without receipt – a hijacked account can be used to purchase items online and then return the items in store for a refund
• buy online, pick up in-store – similarly, scammers can exploit this value-added service by using hacked online accounts to secure goods in store

Our own cyber defence centre and incident response experience suggests that retailers are simply overwhelmed by these attacks, and struggle to put an effective cyber security defence and response plan in place – their strategy is simply to hope they are not attacked.

Strengthening retail cyber security

Retail is not only a cyber target because of its concern about customer experience, as in this sector extended supply chains can offer rich pickings as the threat actor compromises each part of the chain.

Threat actors are attracted by a range of weaknesses and businesses must be alert to wider risks. For example, IT systems often become disjointed – and vulnerable – due to growth by acquisition. Cost pruning may reduce the number of IT staff, let alone cyber professionals. Human error is also a common factor in cyber security vulnerability – if most of your workforce has poor cyber hygiene, this can create a tempting target.

The key to strengthening your cybersecurity is accepting that you can’t solve all its challenges by yourselves. To get ahead, consider contracting with third-party specialist cyber providers offering a wide range of cyber solutions such as Managed Data & Response, ediscovery, eforensic, and incident response expertise.

Key steps for protecting your business from cyber threats

Cyber attacks are not going away as retail remains a rewarding target for threat actors. To protect your business you need to invest in cyber security

• cyber hygiene is a board level issue, so make it one and invest appropriately before it’s too late
• engage with third party vendors who have professionally certified UK-based security operations with 24/7 monitoring services
• ensure a cyber team can travel to your sites as required for advice and breach and remediation responses as required
• ask the vendor for security assurance help which you can leverage for changes, updates etc
• ensure all companies in your supply chain are adopting an equally robust approach to cyber defence

For more insight and guidance, get in touch with Vijay Rathour.