Katie McHone-Jones kmchone-jones@YourNHPA.org Event Manager & Retail Support
Natalie Harris Data & Information Coordinator
ADVERTISING
Dan Simon Magazine Sales 800-737-0107 | dsimon@YourNHPA.org
Qualities of a Leader
Each year, NHPA recognizes some of the best young retailers in the industry for the different ways they have grown their businesses, served their communities and made their mark in the independent home improvement sector. Paint & Decorating Retailer talks to former Young Retailer of the Year honorees about what they have learned about leadership since being honored.
“Being chosen as a Young Retailer of the Year is a high honor. These retailers exemplify the determination and innovation that keep our industry growing.”
The North American Hardware and Paint Association (NHPA) helps independent home improvement and paint and decorating retailers, regardless of affiliations, become better and more profitable retailers.
NHPA EXECUTIVE STAFF
Bob Cutter
President & CEO
Dan Tratensek
Chief Operating Officer & Executive Vice President of Publishing
David Gowan
Chief Financial Officer & Executive Vice President of Business Services
NHPA BOARD OF DIRECTORS
CHAIRMAN OF THE BOARD
Daniel Harris, Palos Ace Hardware, Palos Heights, Illinois; Lemont Ace Hardware, Lemont, Illinois
EXECUTIVE VICE CHAIRMAN
Jared Smith, Jared’s Ace Hardware, Bishopville, South Carolina
DIRECTORS
Craig Bond, Tommy’s Paint Pot, Eugene, Oregon
David Dishke, Grand River Home Hardware, Caledonia, Ontario
Scott Jerousek, Farm and Home Hardware, Wellington, Ohio
Ryan Ringer, Gold Beach Lumber Yard Inc., Gold Beach, Oregon
Jackie Sacks, Round Top Mercantile Co., Round Top, Texas
Matt Woods, Woods Hardware, Cincinnati, Ohio
SECRETARY-TREASURER
Bob Cutter, NHPA President and CEO
NHPA CANADA
NHPA CANADA
Michael McLarney, +1 416-489-3396, mike@hardlines.ca 330 Bay Street, Suite 1400 Toronto, ON, Canada M5H 2S8
CIRCULATION, SUBSCRIPTION & LIST RENTAL INQUIRIES
CIRCULATION DIRECTOR
Richard Jarrett, 314-432-7511, Fax: 314-432-7665
Leading Diverse Teams
The topic of diversity in the workplace is getting increased attention, but Loconsolo Paints in New York already has a long history of creating a safe place for people of many ethnicities to work. See how they have built a diverse team that serves customers well.
OPERATIONS
Protecting Your Data
Security experts say the risk of small businesses going through any type of cyberattack is on the rise. Learn how two retailers responded to ransomware attacks at their businesses in the last year and how you can take preventative measures in your own business.
CATEGORY
An Array of Applicators
When it comes to painting, the right applicator can mean the difference between a job well done and a job not done. At Purcell’s Wallpaper & Paint, employees equip customers with knowledge and options to choose the right applicator.
ONLINE
Get the Latest
Access the following resources plus the latest industry news and exclusive content at PDRmag.com/june
LEADERSHIP
The Power of Inclusion
Learning how to lead diverse teams can empower every staff member. Discover some key resources to help you increase and capitalize on a welcoming workforce.
Change From Within
Creating a more diverse workplace means first taking stock of your business, then figuring out how you want to change. In this conversation with an adviser for the Society for Human Resource Management, discover beneficial first steps to arrive at your goal.
Leadership in Action
Discover how Gina Schaefer, owner of A Few Cool Hardware Stores, welcomed and promoted inclusion initiatives at her stores and how those programs have given her operation the competitive edge.
Enriching Employee Training
Learning to work in a diverse store culture takes practice. In the Trainer’s Toolbox lesson, “Serving Diverse Customers,” employees will explore three scenarios where they must make choices that will either make your customers feel welcome or risk losing them to competitors.
Find More Online
ASSOCIATION
Inside the Classroom
Watch videos of NHPA’s Retail Management Certification Program (RMCP) instructors and students discussing the program’s lasting benefits and sharing the many ways RMCP helped their operations excel.
INDUSTRY NEWS
Understanding DIYers’ Needs
Building products marketing firm Venveo has new insight into where and how DIYers research new home improvementproducts. Put your business at the forefront by reviewing the data now.
EVENTS
NHS Previews 2021
The National Hardware Show is introducing new digital components to help you access new product information and trends all year long. Learn more and register for this year’s event, scheduled for Oct. 21-23 in Las Vegas.
CONNECTIONS
How to Reach Melanie
mmoul@YourNHPA.org
Melanie Moul YourNHPA.org/es-pod
Top-Down Security
We’ve had a rough time in our house recently keeping up on chores. I had to run towels through the wash three times because we kept forgetting to put them in the dryer. We are ignoring the dishes, and we got down to our emergency roll of toilet paper, requiring a midweek run to the store. I know I’m not alone and that many of you have weeks like that in your home and in your business.
The problem with staying on top of need-to-do tasks is that once you get them done, they don’t stay off the list for too long after that. Mix them in with all the once-in-a-while tasks and you have another full-time job.
I’m not here to explain Management 101 to you or to scold you for pulling a clean fork out of the dishwasher as you need one instead of unloading the whole thing at once. But I do want to call your attention to a task that you should bump up the priority ladder: cybersecurity.
Ransomware, phishing, data breaches. They are all different types of cyberattacks your business can experience. And experts say they have become exponentially more common, especially for small-t0-medium size businesses. Just today, we’re reeling from headlines about the aftermath of the Colonial Pipeline ransomware attack, and a new incident has severely affected operations at Ireland’s health services.
Do not make cybersecurity a chore you’re continually playing catch up with.
Now, you may be thinking, “My business is not in fuel logistics or health services, so I’m not sure why these incidents are something I should be concerned about.”
In this issue, we show how this industry is at risk with stories from two retailers whose businesses were breached by ransomware attacks within the last 18 months. They each had varying levels of security and insurance policies in place, but their operations were still vulnerable. Read their stories on Page 28 and find additional resources to help you take the next step to protecting your business at PDRmag.com/ransomware
One lesson these retailers want to pass on to you, their peer, is that cybersecurity is an issue that should be managed from the top down. Just like you wouldn’t ask your kid to help you refinance your house, cybersecurity management and follow through is a job for the primary decision-makers. Do not make cybersecurity a chore you’re continually playing catch up with. Because it will eventually catch up to you.
Melanie Moul Managing Editor
OUTREACH
Share Your Stories
Send your merchandising tips, event recaps, employee morale boosters and other stories to editorial@YourNHPA.org
Portrait of a Store
California Retailer Recognizes Community History With Mural
Shafer’s Ace Hardware in Eureka, California, has a colorful mural that spans an exterior wall of its building and catches the eyes of passersby.
The city of Eureka hosts an art festival every year and chooses an area of the community to improve as part of the event. For the 2020 art fair, the city art council selected the Henderson Center shopping center as the area to spruce up, so Shafer’s Ace owner Jack Rieke hired an artist to paint the large mural on the side of the hardware store. Shafer’s Ace is the largest retail store in Henderson Center.
The project also required Rieke to hire a construction company to replace a whole exterior wall of aluminum siding with boards the muralist could paint more easily.
Eureka is home to a large number of artists, so supporting community creativity is important to Rieke.
He paid local artist Ben Goulart to paint the mural, which is 12 feet tall and 60 feet long.
The hardware store is 60 years old, and the mural shows what the store would have looked like in its early days, but it features current people, including Rieke and his two grandchildren, and products representing other present-day local businesses.
Rieke contributed paint and any other supplies Goulart needed for the project, which took more than two months of full-time work for the artist to complete.
Customers frequently pose for photos with the finished mural and mention it daily to store employees.
“I think it gives back to the community,” Rieke says. “People really like it. They really appreciate the time, energy and money we put into it.”
EDUCATION
Apply by July 1
Visit YourNHPA.org/rmcp to apply or learn more about the Retail Management Certification Program.
Seeing ROI
Impact of a Business Improvement Project
“My project was to raise our gross margin percentage by 1.3 percent for fiscal 2021 over our three-year average. This would put us in line with the NHPA’s Cost of Doing Business Study industry average. I did this by implementing a price change rhythm and started a training program focused on the departments that mattered the most at that time of year. Our results from my Q4 2020 proof of concept were that we raised our gross margin percentage by 3.4 percent in what was traditionally our worst quarter for the metric. This led to an additional $25,201 in gross margin dollars generated in Q4 2020.”
Austin Diehl Director of Retail Operations Randy’s Hardware, Timberville, Virginia
Retail Management Certification Program Class of 2020
Make a Strategic Investment
Enroll in NHPA’s Management Program
If you’re looking to take your leaders to the next level in your operation, advanced training is a smart investment. The North American Hardware and Paint Association’s (NHPA) Retail Management Certification Program is a college-level course that prepares owners and key employees with profit-focused store operations education.
With real-world training and a business improvement project tailored to meet the needs of your business, the six-month program is designed to help business owners see immediate results and a return on investment (ROI).
“The Retail Management Certification Program provides methodologies, ways of thinking and systems so that these students can examine and reexamine their operation,” says program instructor Gary Petz. “As a young manager, I didn’t have that. I had all kinds of information and reports that were on my desk every single day, but I didn’t have a way to take that information and put it into a methodology. This course does that.”
Petz believes anyone in the industry can benefit from the program.
“Employee management, inventory management, learning how to set goals and budgets—all of that is as valid for a paint store as it is for a farm and ranch store or lumberyard,” he says. “This course is about finding advantages to improve your business.”
The deadline to apply for the 2021 class session is July 1.
Students in the NHPA Retail Management Certification Program have the opportunity to learn from industry experts and their peers in a collaborative classroom environment.
Explore Your Options
Visit YourNHPA.org/membership to learn more about additional training and other member services.
Build a Positive Work Cultur
Find the activity “Serving Diverse Customers” at YourNHPA.org/trainers-toolbox
One component of great customer service is treating all customers with respect so anyone feels welcome at your business. And sometimes that takes a little training. You can help employees learn how to respond to unknown situations by giving them sample scenarios to work through.
This month’s Trainer’s Toolbox activity, “Serving Diverse Customers,” guides learners through three possible scenarios they could encounter in a retail environment. Specifically, these scenarios focus on helping employees understand how to serve diverse customers and create a culture built on respect for others.
Culture
Get a Free Business Analysis With This Year’s Study
Participation in the Cost of Doing Business Study is free, easy and confidential. To learn more or get started, visit YourNHPA.org/codb
Submit your information today for NHPA’s 2021 Cost of Doing Business Study. This financial benchmarking tool delivers data and insights that allow retailers to increase profits and strategize for their financial future and success. By participating in the study, you’ll receive a free copy of the study along with a personalized financial analysis of your operation with ratios and other financial tools. See Page 43 for a quick way to submit your information online.
Access Affordable Insurance
For information about the NHPA Health Insurance Program, visit YourNHPA.org/health-insurance
Did you know you have access to affordable group health insurance through your association? The NHPA Health Insurance Program, managed by Custom Benefits Insurance Group Inc., is a group health insurance plan that allows independent operators to access benefits at lower rates due to the volume of retailers who participate in the nationwide program.
PRODUCT NEWS
OUTREACH
Retailer Recommendations
Send an email to editorial@YourNHPA.org telling us about the products your customers love and why they are such a hit in your business.
CABINET GRAIN FILLER
AQUA
COAT
|877-886-2422 or aquacoat.com
Aqua Coat White Cabinet Grain Filler is a white gel used to fill pores and grains of wood surfaces. The grain filler seals the grains and pores of the wood, minimizing the absorption of the primer and paint when painted. It is water-based, nonflammable, noncombustible, low odor, low VOC, easy to apply, fast drying and cleans up with water.
INSECTICIDE PAINT ADDITIVE
SUNNYSIDE CORP. | 847-541-5700 or sunnysidecorp.com
M-1 Advanced Insecticide Paint Additive is designed for interior and exterior use and is EPA registered. It is effective against crawling and flying insects when exposed to treated surfaces. Pests affected include cockroaches, spiders, ticks, mosquitoes, citrus weevils, fire ants, leafcutter ants, silverfish and more.
PAINT ODOR ELIMINATOR
PAINT SCENTSATIONS |paintscentsations.com or 888-771-9065
KABOSH! is an odor-neutralizing paint additive. It eliminates 75 to 90 percent of paint odors and will not affect paint adhesion, hardness or performance. It works in most paints, stains, primers, epoxies and other surface coatings and is ideal for commercial contractors painting in occupied buildings.
DUST CHANNELING DRYWALL SANDING SPONGE
3M | 888-364-3577 or 3m.com
3M’s Premium Dust Channeling Drywall Sanding Sponges feature patterned sides to channel dust away from surfaces. They use premium mineral grits for effective hand sanding and will not discolor the surface being sanded. Angled sides help sand hard-to-reach areas and they’re suitable for wet or dry sanding. Dust Channeling Drywall Sanding Sponges are available in a range of grits.
Retailers’ Picks
Check out the products that caught retailers’ eyes in the special presentation of the 2020 Retailers’ Choice Awards at YourNHPA.org/webinars
PATTERNED PAINT ROLLER
ROLLERWALL |rollerwall.com or 301-838-0450
The Rollerwall Pattern Applicator includes a frame, handle and foam feeder roller. The lightweight handle has a threaded hole for extension pole attachment. The foam feeder roller holds enough paint for three full passes down a wall. is designed for tiny tasks like earth magnets. Teeny Turner is available in multiple colors.
PAINT TRIPODS
ALLWAY TOOLS |allwaytools.com or 718-792-3636
Allway’s Painter’s Tripods can interlock for added stability. Their nonstick points allow painters to paint one side of a door, panel or other flat surface, then flip and paint the other side with minimal waiting to finish jobs faster.
DRAWER PULL & CABINET KNOB
DOUG MOCKETT & CO. |mockett.com or 800-523-1269
The Treasure Chest Drawer Pull & Cabinet Knob mounts directly on to drawer faces. Stop points on the latch keep the ring from slamming against the drawer face or swinging over the top and hitting the top side of the drawer. It features a satin nickel finish and measures 2 ⅝ inches long (1 ¼ on center).
WOOD STAINS THAT
Natural
Dark Walnut
Espresso
Dark Mahogany
Pickling White Weathered Wood Spanish Oak
Carbon Black
Coming Soon
Update your email preferences at YourNHPA.org/subscribe to be sure you’re on the list when a new products newsletter launches next month.
CONCRETE AND ASPHALT PATCH
AQUAPHALT |aquaphalt.com or 434-906-1273
Aquaphalt is a water-activated, permanent asphalt and concrete patch material. It can be installed in below freezing temps and high summer heat. Patched areas can be opened to traffic or use right away. Installation is simple with no large crews or heavy equipment needed. Aquaphalt is backed by an unlimited curing guarantee and three-year warranty.
ERASABLE MEMO PAD
LUX KAMI | luxkami.com
WEMO is an erasable silicone band to write notes on with regular pens or markers. The unique coating erases with a finger or an eraser. Developed for nurses as an alternative to writing vital notes directly on their skin, WEMO is suitable for any application where handy note taking is desirable without carrying a lot of supplies supplies.
FLEXIBLE RESIN MOLDINGS
WHITE RIVER HARDWOODS | whiteriver.com or 800-558-0119
Ultra-Flex Resin Mouldings from White River Hardwoods are available in a variety of motifs including rope, fluted, acanthus and more. They’re manufactured with a latex-based primer coat and can be finished with the same process used to finish other wood moldings.
PAINTER’S PANTS
THRIVE WORKWEAR CO. 719-963-7223
5000-PROKnee Pad
Painter’s Pants feature Squish® Pad Technology built into the knees. They’re made of ActionFlex® fabrics for comfort and mobility with modern design fit and style. Similar styles are available without knee pads and in shorts.
- Eliminate the need to clean on breaks
- Fits multiple brush and roller sizes
- Reusable or simply dispose/recycle
- Toolbox friendly - unlike bulky protectors
- Saves time, saves water, saves paint
- Easiest way to have a completely flat surface after repair
- Drywall plugs ensure a solid repair with NO hollow spaces
- Hang items on repaired area with ease
- Ideal for drill-and-fill-insulation projects
UX-Line
T-Line
- Easy to clean
- More durable than ever
- Solid, all-steel construction
- Slides in & out of pocket easily
- “Unibody” one-piece construction
- Built-in hammer end to reset nails
- Comes with superior comfort & balance
- Great control and easy clean up
- Handle crafted to avoid fatigue
- Easy to clean, just wipe after use
- Reach corners and bottoms
- Containers will not be damaged
- Secure connection to drill
- Less air bubbles during mixing
NARROW BUNG HOLE MIXER
A DIVERSE TEAM LEADING
HOW AND WHY TO BUILD AN INCLUSIVE WORK CULTURE
By Kate Klein
Most customers who shop at Loconsolo Paints’ Coney Island location in Brooklyn, New York, speak Russian or English, not usually both. To be able to best serve the customer base in the area, executive vice president Jonathan Chiaro recently prioritized job applicants who speak Russian.
“Those two languages in that particular store are ones we home in on because those would help us best serve our customers,” Chiaro says.
The company, which operates four paint stores in New York, serves diverse communities with varied requirements. Serving multicultural customers well requires hiring diverse employees—in culture, language and gender.
Key questions Chiaro asks prospective employees during every job interview include, “Is English your primary language?” and “Do you speak any other languages fluently?”
But according to Chiaro, even if all of Loconsolo Paints’ customers were from one culture, the company would still benefit from stretching its norms and becoming increasingly inclusive.
“Every time we’re open to change, we get better for it,” Chiaro says.
Read on to learn about the company’s history, how the operation has evolved over several decades and how its leadership team navigates the benefits and complexities of leading a multicultural team of employees.
Diverse Teams Strengthen Your Business
Gina Schaefer, owner of 13 hardware stores in Maryland and Washington, D.C., offers insights on leading diverse teams in a webinar at YourNHPA.org/webinars
STRENGTH IN DIVERSITY
Diversity on
allows them to better serve customers representing a variety of ethnicities, cultures and languages.
From left: Vivian Santiago, Paul D’Auria, Jonathan Chiaro, Gulomjon Marupov and Oscar Ramirez are members of the team at Loconsolo Paints in Coney Island, New York.
the team
BETTER TOGETHER
Loconsolo Paints has developed a strong team of diverse employees, including retail sales team member Sofiia Lenkova, who work together well to meet the needs of the company’s varied customers.
Land of Opportunity
Chiaro’s grandfather John Loconsolo was an Italian immigrant who started a paint contracting business with his father in the 1920s in New York.
“Painting has been a job that a first-generation person coming into the country could do,” Chiaro says. “We’ve seen that with my family and with the waves of Italian, Hispanic and Russian immigrants coming here.”
Chiaro’s grandfather and great-grandfather built a thriving business. Their contracting company painted the original World Trade Center and every major bridge in New York City.
The first Loconsolo Paints store, opened in the 1950s, served as a source of paint and other supplies for the family paint contracting business.
The paint contracting business supported John Loconsolo’s growing family and myriad employees. But he had eight daughters and no surviving sons. Passing on the family name and the family business to a son were culturally important to him.
Without a son, he chose to sell the paint contracting company in the 1990s and kept the store.
“He didn’t feel like any of his daughters would go into the business, but my aunt said she wished she had the opportunity to have a more proactive role,” Chiaro says.
The Present
New waves of immigrants, changing times and younger generations of Loconsolo’s family growing up in the company have brought positive progress to the business, Chiaro says. He and his cousin Paul D’Auria now run the operation together.
Loconsolo Paints had one retail store and six employees when Chiaro and D’Auria took on leadership roles in the company. They have focused on growth, adding more locations and expanding the staff and customer base.
The paint retail company now has four locations and about 30 employees representing 14 different nationalities and speaking nine languages.
The employees are representative of the communities where the stores are located, since Chiaro intentionally hires people who live near the stores.
“We are in a community of first-generation immigrants, so it’s easier to find people in the community who meet our needs,” Chiaro says.
As community members, the workers are serving their diverse neighbors.
“One of our goals has been to create a diverse store environment because that’s what our customer base is,” Chiaro says. “Customers want to feel comfortable and speak in a language that is comfortable for them.”
When possible, the team matches customers with the salespeople in the stores who fluently speak their language.
“The more diverse we are, the more ability we have to make the customers comfortable and keep them coming back,” Chiaro says.
Hiring a Diverse Team
Hiring from a diverse community naturally results in a diverse employee team if the store leadership is open minded, Chiaro says. He still views the paint industry as a great launching point for first-generation immigrants.
Loconsolo Paints doesn’t hire based on where prospective employees are originally from, but Chiaro does try to hire within each store’s community so the workers’ commutes are short and staffing the store’s early operating hours isn’t difficult.
He also wants the employees and customers to be able to relate to each other well so customers feel more at ease shopping at Loconsolo Paints than at competitors.
“When we evaluate someone, we look at their experience and personality,” Chiaro says. “Are they friendly, energetic? Are they looking to learn? Do we think they’re going to be reliable and trustworthy? We then narrow our candidate pool down by who might associate
better with the customers in the specific area. What are the needs of the store to serve our local community?”
Chiaro and D’Auria require employees to have at least some English language proficiency because they don’t speak multiple languages and need to feel confident their employees understand them well enough to be trained on store policies and procedures.
However, they can be flexible to hire the right people. Chiaro would be willing to bring in a translator’s help, if necessary, but that hasn’t been needed yet. A current manager on staff spoke very little English when Chiaro first hired him, but Chiaro saw potential and offered grace for the social cues the manager didn’t pick up on because his English was so limited.
Already having someone on staff who speaks a person’s primary language would make it easier for Chiaro to hire a person with limited English skills.
“We take it all on a case-by-case basis,” he says.
Origins of the Loconsolo Paints Team
The employees at Loconsolo Paints represent 11 different countries and speak nine languages. They supplied their demographic data voluntarily, and employees are not required to share this information to be employed at Loconsolo stores.
PUERTO RICO
BROADEN YOUR REACH
Nurturing Inclusion on Your Team
Diversify your marketing. Find out what local TV, radio, newspaper and other media sources operate in your community in different languages. Learning what’s available may be as simple as asking your employees what TV stations are their favorites in their preferred languages. The staff at Dale Hardware in Fremont, California, identified where to advertise and then had employees who speak Mandarin appear in a commercial on the Chinese TV station.
Use technology for quick help. When communicating with co-workers or customers who don’t fluently speak your primary language, use a mobile app to help translate what they’re asking and what you need to say. Dale Hardware employees have used Google Translate and Apple’s Translate app.
Make your store environment inclusive. Adding directional and product department signage in all of the languages spoken locally makes your store more shoppable and welcoming for customers who don’t speak English as their first language.
Leading the Team
Training and leading a diverse team requires patience, mutual graciousness and a willingness from Chiaro to learn about other cultures so he can help different people work together well despite cultural differences.
Culture-related clashes are rare among employees, but his team has always been able to work through differences with a little coaching. For instance, when an employee from Peru and an employee from Chile offended each other and argued about a historic battle between their countries, Chiaro was able to respect the pride each person had for their country while encouraging them to get along.
He has also had conversations with employees about cultural differences in communication. A Russian manager wasn’t intending his voice to sound angry, but some workers felt like he was yelling at them.
“Different cultures have different experiences,” Chiaro says.
His patient leadership begins in employee training when he is learning how best to teach new hires to mix paint and master other tasks before he knows the new staff members well.
Chiaro needs to know employees understand him well enough that they can follow instructions. Teaching product knowledge can be simpler than teaching how to mix paint or provide good customer service because many manufacturers provide product information in multiple languages.
Chiaro tries to demonstrate every task and explain processes very slowly in English when he isn’t sure an employee has strong enough English to comprehend him quickly. Then he pairs the new employee with an experienced staffer who speaks the same language, if possible, to work together until the new worker is competent enough on their own.
“In general, people work together really well. We look for people who will be patient, calm team players.”
—Jonathan Chiaro, Loconsolo Paints
For example, if Chiaro isn’t sure a newer hire can capably mix paint without making mistakes, he will have the new person repeatedly watch a seasoned employee do the task.
“You have to do a lot of hands-on work, visually showing what you want, be patient and allow people to make mistakes,” Chiaro says. “You do a lot by trial and error. You have to watch carefully for any areas where you think a mistake might become a major issue with a significant financial impact.”
The effort required for such patient training is worthwhile for creating a cohesive team that can serve a diverse customer base full of professional contractors, many of whom are first-generation immigrants.
However, the characteristics Chiaro looks for in employees transcend differences such as ethnicity, culture and language.
“In general, people work together really well,” Chiaro says. “We look for people who will be patient, calm team players.”
WORLD-CLASS SERVICE
Oscar
Ramirez, paint-mixing specialist for Loconsolo Paints, serves on a team of employees that represents approximately 14 different nationalities and speaks nine different languages.
Bytes Back WHEN TECH
IHOW 2 RETAILERS RESOLVED RANSOMWARE ATTACKS
By Melanie Moul
t’s 6 a.m. on the Friday before Memorial Day. You anticipate it will be your busiest sales weekend of the year. A text pings on your phone, and the message makes you bolt upright in bed. It’s from your IT staff member and it says: “I think we’ve been hacked.”
You blink a few times just in case you didn’t read it correctly, but it isn’t a dream. In fact, it’s a waking nightmare, and for many small-to-medium-size businesses (SMBs), cybersecurity incidents are becoming more common.
According to a 2019 report from business insurance company Hiscox, the proportion of SMBs that have experienced a cybersecurity event, like a data breach or hack, increased 59 percent in one year. And the COVID-19 pandemic has only accelerated the incidents, with cybersecurity firm Check Point Research reporting that ransomware attacks doubled from the second to the third quarters of 2020.
Even as this article goes to print, headlines feature the Colonial Pipeline ransomware attack that severely impacted operations at Colonial Pipeline, which supplies fuel from Texas to New Jersey.
On the following pages, read two stories from retailers who have come out on the other side of ransomware attacks at their operations. These retailers are sharing their stories because they want their peers to know that this industry is not immune to cybersecurity incidents. We are presenting their experiences anonymously at their request, but these stories are factual and occurred within the last year to 18 months.
Expert Opinion
On the latest episode of the “Editorially Speaking” Podcast, Melanie talks to Zarmeena Waseem from the National Cyber Security Alliance. Listen at YourNHPA.org/es-pod
To Pay or Not to Pay
Making a Choice Before You’re Hacked
Hardware Store X had a team of professionals acting quickly to find the source of the breach and to negotiate with the malicious actors to regain access to their network. The core of that negotiation was to determine the price of the ransom Hardware Store X would pay—through their insurer—to get their data back. But paying the ransom isn’t the only option, and it’s something Hardware Store X owner Greg* says he may do differently next time.
“Before you even get into this situation, you have to make a decision about whether you’re going to pay a ransom or not,” Greg says. “There’s no right or wrong answer, but if you’re going to go the way of paying the ransom, it underscores the need of having the right type of insurance.”
On the other hand, Greg says, there’s a good reason to not pay a ransom.
“The ransoms are getting more expensive because more people are paying them, and in turn, it’s feeding the industry,” he says. “Our industry is pretty fiercely independent, and I think most people wouldn’t want to support an industry like that by paying ransoms. I like that mindset.”
So what is the key difference when you are deciding whether to pay a ransom?
Backups, Greg says.
“As a small business owner, you need to double down on data backups if you decide you’re not going to pay,” he says. “You have to do the basics no matter what. Require strong passwords, use two-factor authentication. But then you have to take your backup strategy to the next level.”
Learn more about how to protect your data at PDRmag.com/backups
*Not his real name
Your Worst Wake-Up Call Yet
That Friday morning scenario is how it really started for the head of IT at Hardware Store X, who we will call Tim. Upon reading the text message, and after notifying the store owners, he rushed to the main office. The IT employee had found a note in the system that demanded payment in order for the company’s data to be returned.
Tim’s first step was to unplug the firewall.
“The firewall is the connection to the internet, and not many people think about that hardwired connection,” Tim says. “Most people think to turn their computer off, but when you do that, you can permanently corrupt the server, and when you restart, your files will be inaccessible because they will all be encrypted.”
Turning off the internet connection breaks the access point for the hackers so the type of virus or malware they’ve installed can’t communicate with its directors anymore, he says.
His next step was to contact the insurance company. In this case, Hardware Store X’s insurance company coordinated a loss firm, a security agency and a negotiator. Their insurance policy made this multipronged response possible.
“I was so appreciative that we had an insurance policy that covered us. Not only for the financial coverage, but also for the expertise,” Tim says. “We would have jumped into this situation not knowing where to start. They held our hand for the entire process.”
The teams were on the project within two hours of Tim making the call. The security company immediately started going through the network, figuring out what had happened and when. In addition to identifying the entry point—where the hackers got into the system—the security company was also looking to see what data was impacted, in case Hardware Store X would need to notify customers or employees of the breach.
In this case, the hackers found an insecure username and password that allowed them access.
Know the Beast
Learn the different types of malware and viruses that your operation could be vulnerable to at PDRmag.com/breach.
“There are a number of different ways to get ransomware,” Tim says. “For us it was a brute force attack: They found a hole in our firewall and kept trying usernames and passwords until they found one that worked and were able to break into it.”
Although this was a serious cybersecurity incident, the hackers weren’t able to access sensitive information.
“While they did encrypt some important files, they didn’t get any customer, employee or credit card information,” Tim says. “Nothing was stored where they could access it. We felt good about that because we didn’t have to notify our customers that there was an incident.”
In addition to not needing to tell customers because there was no threat to data, Hardware Store X owners also only told a handful of employees who were critical to the recovery effort.
“We didn’t know what was going on right away, so only the owners and the IT team were informed,” Tim says. “We notified our stores and the staff members who were working remotely that we were having network issues at the main office. We didn’t want rumors starting or anything to get out to customers.”
The Impact
Although the incident occurred ahead of Hardware Store X’s highest sales weekend in company history, fortunately there was little interruption on the customer side. One significant effect was on e-commerce because the communication with inventory systems was down.
“We chose to shut down our ordering system so our IT team could focus on getting us out from underneath the ransomware,” Tim says. “We put a notice on our website that the online ordering system was down so customers wouldn’t try to place orders.”
TheResolution
As the security team learned more about the hack, they were able to determine the organization that was behind it.
“Our team had dealt with this group before, and they were able to confidently say that if we paid the ransom, there was a good chance our files would be restored,” Tim says. “One of the fears is that you pay the ransom and they ask for more money or don’t give you the decryption key.”
After nearly an entire day of negotiations, both groups agreed on a ransom amount. The hackers asked for payment in bitcoin, a type of cryptocurrency, which is commonly used in ransomware incidents.
Once the ransom was paid, the hackers sent over the decryption software, and IT staff members got to work recovering their data.
“Decrypting took about five days,” Tim says. “We tore apart our firewall and rebuilt it. It took us a while to get everything back into place.”
“The key is to mitigate the risk and come up with better systems to create less of an impact on operations and protect sensitive data.”
TheAftermath
Since the incident, Hardware Store X has made some changes to operations and systems to enhance security and make it more difficult for hackers to gain access.
“We added in endpoint detection-and-response software on every computer,” Tim says. “It’s a system that is managed 24/7 by a security team that looks for unusual activity and can stop anything before it happens.”
Additionally, they have improved the strength of passwords and implemented two-factor authentication (2FA) for anyone to access the VPN or email. Anyone who logs in needs to confirm they are who they say they are on a separate device before logging in.
Tim says they didn’t think their company was at risk five years ago, but the environment has changed a lot in that short period of time.
“Everybody’s at risk. I think we’re still at risk. You can do whatever you want with security and still be attacked,” he says. “The key is to mitigate the risk and come up with better systems to create less of an impact on operations and protect sensitive data. Having off-site backups is critical because those could make it so you don’t have to pay a ransom.”
Before the Hack
3 Steps You Can Take Today to Protect Your Business
Confirm your insurance coverage. Both Hardware Store X and Y had insurance, but it’s important to confirm you have the right type of coverage. Hardware Store Y had cyber insurance, but ransomware wasn’t part of their package, which means their insurance didn’t cover the actual cost of the ransom. Talk to your insurance broker to be sure you have the right protection.
Enact password security. One key way malicious actors find their way into vulnerable systems is through weak passwords. Such was the case for the Hardware Store X, which had an administrator username and password that was easy for the hacker to guess. Two-factor authentication (2FA) helps mitigate hacking because it requires a person to confirm their idenvtity on another device before they can log in. Requiring strong passwords, regularly changing passwords and employing 2FA will help make your system more secure.
Talk about the risk internally. With cyberattacks on small-to-medium size businesses only becoming more frequent, experts say it’s not about if your business will be breached, but when. Be sure everyone on your executive team and key managers understands and agrees on the risk to your operation. Buy-in from every decision-maker is critical to protecting your business.
CASE STUDY 02
Not Just Another Day at the Office
On a Friday last fall, Hardware Store Y president Paul* got in the office early and something wasn’t right.
“I couldn’t log into my email, and our ERP systems weren’t working,” he says. “Usually when there’s an IT issue, I text our IT team, but this time I called them. My director told me it probably wasn’t too bad because everything was down. Then he discovered the ransom note the hackers had left in our system.”
The hackers were asking for more than $1 million for Hardware Store Y to recover their data. The IT staff did an internal assessment to determine what areas had been breached, and they discovered the hackers had deleted their data backups.
“We thought we were fine because we had remote, robust backups,” Paul says. “Except they were accessible by administrators, which is how the hackers got into them.”
Paul called his insurance company and discovered they had cyber insurance and kidnapping and ransom insurance, but not ransomware insurance. It was going to cost an additional $70,000 for the security team to determine the entry point, identify the hackers and address the situation.
“Because the hackers had deleted our backups, we didn’t have any other option,” Paul says.
The security team worked all day Friday to determine how the hackers had entered the system. An employee had downloaded a PDF from their personal email account they accessed on a company device on their lunch break. The PDF executed a program that allowed the hackers to access the network, where they made their way into Hardware Store Y’s admin accounts, where Paul admits password security was lacking.
*Not his real name
True or False?
Test your team’s knowledge about cybersecurity with the questions at PDRmag.com/cyber-faq.
The Impact
Fortunately, customer-facing data and operations weren’t significantly affected. However, the hackers accessed extremely sensitive company and employee information, including tax returns and human resources documents.
“As part of their ransom demand, the hackers were threatening to release that information on the dark web, which presented a lot of liability for us,” Paul says.
Despite the hackers having that data, Paul says they felt their employees’ information was secure because the payroll system wasn’t hosted on-site.
“The number of impacted employees was low, but we did tell our team there were some minor breaches, and we talked to those people individually,” he says.
Hardware Store Y offered all employees a Lifelock subscription to give them an extra level of security, and about 40 percent of employees took that opportunity. There have been no flags or concerns that have arisen for those who opted into that program.
Although customer data wasn’t impacted, Hardware Store Y sent a letter to customers explaining the breach and the data that was impacted.
The Resolution
Paul gave the negotiations team a budget for the ransom, and they spent Saturday into Sunday attempting to strike a deal. While many hacking organizations are well known to negotiators, this group apparently had broken off from a main organization. The negotiations team didn’t have confirmation they would follow through with their end of the deal upon receiving the ransom payment.
“What’s important to note about these organizations is that they are professional criminals,” Paul says. “They research companies that are vulnerable but that also have the ability to pay ransoms. They refer to you as their ‘clients’ and they have help desks that walk you through the decryption process.”
The final ransom amount totaled nearly $800,000, and the hackers showed proof that they deleted the files, but Paul says there’s no way to know if they made copies.
After receiving the decryption key, Hardware Store Y hired extra IT staff to come in to help unravel the damage, a process that took about a week to complete.
The Aftermath
This incident occurred about nine months ago, and Paul says they just recently wrapped up the last step, called an “extermination event.”
“The difference between those who pay and don’t pay ransoms is secure backups.”
“We couldn’t guarantee they were completely out of our systems until we reset everyone’s user ID and password, as if they were brand new,” Paul says. “We were fortunate throughout the entire process that we were able to do business and never missed a delivery, but it took about six months to get through everything.”
And now there are systems in place that are intended to prevent another hack of that magnitude.
“In order to get ransomware insurance, we needed to have systems in place to prove we were doing everything we could to prevent another attack,” Paul says.
Hardware Store Y upgraded security, including adding what is called endpoint detection software. The programs are monitored by professionals and detect unusual activity on a network within minutes. They also implemented 2FA to access the company VPN and the backups.
“The difference between those who pay and don’t pay ransoms is secure backups,” Paul says.
In addition to enhancing password security, Paul recommends investing in a password management system, and not keeping company passwords in a spreadsheet on the network. Limiting internal access to sensitive documents is critical, too, Paul says.
“You have to segregate sensitive data. The HR folder was secured with a password, and it was still stolen,” he says. “Just don’t keep HR data in a place where people can find it.”
Finally, security only works when people understand the risks and how the systems work. Work with your IT company or even your insurance company to set up training for your whole organization so everyone understands the risk.
Paul says these decisions need to be made and monitored by members of the executive team, not just relegated to your IT staff or vendor.
“Do not just go to your IT team and ask them if your business is safe,” he says. “As the leader of your organization, you need to be consulting with experts and following up to make sure your systems are protected.”
Above A Brush
EDUCATING YOUR CUSTOMERS ON PAINT APPLICATORS
By Lindsey Thompson
rushes, rollers and applicators present a significant opportunity for retailers to not only sell more product, but educate and inform customers, hopefully earning repeat customers in the process.
When it comes to paint applicators, the choices are nearly endless. Many brushes and rollers appear similar to some customers, especially DIYers, so they might not understand the nuances of different types of applicators and which ones to use for the paint job they want to tackle.
Purcell’s Wallpaper & Paint has been successfully selling paint, applicators and other sundries for over 40 years and has established itself as a trusted source for both DIY and professional customers.
With three locations in Syracuse, New York, the paint applicator category at Purcell’s has continued to grow, offering an opportunity to connect with and educate customers and add to the company’s bottom line.
Choosing an Applicator
Give your employees the answers to your customers’ FAQs about applicators at YourNHPA.org/product-knowledge.
When he first started with the company nearly 30 years ago, Purcell’s president Todd Halbig says one of his favorite parts of the job was product merchandising. The stores carried a broad selection of applicators, but Halbig merchandised and organized displays to make them easier for customers to shop and find what they needed. Now, each Purcell’s location has a whole wall of well-organized brushes, rollers and applicators, with several hundred SKUs in the category.
“Things have really changed over the years. Now we hardly have any paint in the actual retail space. It’s all applicators, brushes, rollers and other paint accessories,” says Halbig. “Our customers know we have paint, but it’s important we show them we have all the extras they need as well.”
Purcell’s has found success in this category through a carefully curated selection of merchandise, knowledgeable employees and creative merchandising.
PLENTY OF PAINTBRUSHES
Offer the Right Options
The selection of paint applicators at Purcell’s is varied, but it isn’t built without careful consideration.
Halbig says carrying American-made products is the biggest factor when choosing products because he wants to support U.S. companies.
“Our customers know we have paint, but it’s important we show them we have all the extras they need as well.”
Todd Halbig
Purcell’s Wallpaper & Paint
Halbig also wants to give customers options in quality and price. The store has many of its applicators and other sundries divided into good, better and best categories because not every project requires the same quality brush or roller.
“Someone may use a toss brush for a quick touch-up, a premium brush for painting a piece of furniture or trim and a better brush for things like exterior painting, where the brush gets beat up faster than interior painting,” Halbig says.
Offering good, better and best options also follows the company’s philosophy to be sure each customer has a choice, says Halbig. The stores also sell various price levels, from the higher end to the lower end and everything in between.
Purcell’s inventory tracking system is also crucial to knowing what to stock, as it tracks what paintbrushes and rollers sell the most, so Halbig knows what to keep ordering.
Many of the paintbrushes sold at Purcell’s Wallpaper & Paint are made in the U.S.
Teaching Upselling
Discover best practices to share with your employees to upsell paint products at YourNHPA.org/employee-training.
Educate Your Employees
Well-educated employees are another key to Purcell’s success in selling paint applicators. The employees go through frequent training sessions from the vendors the company uses to stay on top of the ever-changing paint applicator market.
“Our vendor agent is our go-to for training and new products,” says Halbig. “They make sure we know about new products, trends and changes, and they keep us up to date with what works best with the paints we sell.”
Many of Purcell’s employees also use the paint and applicator products they sell in their own homes and test them out in the stores, giving them firsthand knowledge they can share with customers.
“It’s much easier to sell paintbrushes and rollers when we’ve actually used them,” Halbig says. “We use them in our own homes or get them out at the store to get a sense of how they work, so we can explain that to customers.”
Once a Purcell’s employee educates the customer on the best applicator for their needs and narrows down the choices, they leave it up to the customer to choose the actual product. The stores carry brushes with different types of handles and varying sizes, so customers can pick what is most comfortable for them.
“We never grab the brush for the customer, but want them to choose one that feels the best to them and is in the price point and quality category they want,” says Halbig. “If they’re comfortable with a brush, they’re going to paint better.”
Along with paintbrushes, Purcell’s carries a large selection of rollers and applicators that suit a variety of jobs.
ROLLING WITH OPTIONS
3 BRUSH BASICS
One size doesn’t fit all when it comes to paintbrushes. Help customers choose the right applicator by brushing up on these paint tool basics.
TYPES OF BRISTLES
The bristles in a paintbrush are typically made of natural materials or animal hair, which are best for oil-based paints, varnishes and polyurethanes, or synthetic materials like nylon or polyester, which work well with latex paints. Brushes with stiffer, shorter bristles hold stain and varnishes better and allow for fewer drips.
SIZES
Paintbrushes come in a variety of sizes, but the most common sizes are 1 inch and 2 inch for trim, 3 inch for doors and cabinets and 4 inch for large, flat spaces.
SHAPE OF BRISTLES
Brushes with angled or slanted bristles are best for trimming corners and edges, while squared-off bristles are used primarily for flat areas. Rounded sash brushes work best for small trim and faux finishing.
ASSORTMENT OF APPLICATORS
When it comes to painting walls and trim, brushes and rollers get the job done, but for more specialized projects, your customers will want a more specifically designed applicator. Knowing what’s available and how customers can use them for special projects is an easy way to increase add-on sales. Here’s a breakdown of the different types available.
Paint pads are flat, handheld applicators that create straight lines and are ideal for painting ceilings, trim and tight areas.
Paint mitts are typically made of lint-free fabric and allow for better coverage when painting railings, fences and irregular shaped items.
Corner rollers are made of foam and fit into most corners, applying paint to both sides of the corner at one time.
Stencil brushes are used with paint stencils, have firmly packed and short bristles and come in different widths.
Look Beyond the Shelves
When the pandemic prompted shutdowns across the world, Purcell’s also had to close its doors to in-person shopping, but got creative to continue selling applicators.
“At the start of the pandemic, we were crazy busy, but right before everything shut down, we got a little scared because a lot of other independent retailers were closing their doors and going curbside, which is fine for some products,” Halbig says. “But for things like applicators, customers can forget what they need and what we have.”
Taking advantage of the large windows at the front of each store, Halbig created a board of the top 20 applicators in the store and displayed it in the windows for customers to see. He also posted the board on the company’s Facebook page.
The store displayed similar boards previously for different trade and customer shows. Halbig took the concept and tweaked it, creating a useful and innovative way to sell paint applicators.
“Along with the menu board, we had a sheet with a corresponding key so when people called and said, ‘I want No. 1 or I need No. 2,’ we knew what they needed, and we could easily fulfill their order,” Halbig says. “Our customers loved it. When they couldn’t come into the store, it helped them remember what they needed.”
The DIY Factor
Get more insight from Venveo on how DIYers are shopping by visiting PDRmag.com/diy-2021
AT HOME WITH
Home Builders
Understand the Retail Needs of In-Demand Pros
Marketing firm Venveo teamed up with The Farnsworth Group to survey 101 residential contractors on how their shopping patterns have shifted in the past year. The results offer valuable insight into what pros need. As monthly home starts hit their highest pace since 2006, understanding their needs can put you one step ahead of your competitors.
Home builders have a digital focus.
Currently, 43 percent of home builders purchase home improvement products online for delivery or store pickup, much higher than in years past.
PUT IT TO USE
If you don’t already, speak to your wholesaler about incorporating e-commerce options on your website.
New brands are gaining traction.
Data indicates about one-third of home builders have tried a new brand of product in the past year. Many switched because of product availability.
Source: Venveo/The Farnsworth Group
PUT IT TO USE
Product availability is key. Communicate your inventory accurately and immediately to gain customers’ trust.
Your website helps home builders find products.
Home builders are looking for new brands, and 64 percent of them use supplier or retailer websites to find them. About 80 percent found products on YouTube.
PUT IT TO USE
Use your website to feature YouTube videos to drive engagement—and discovery—across your online platforms.
Scan the QR code or visit YourNHPA.org/codb to submit your information online.
Compare. Assess. Improve.
When you participate in the Cost of Doing Business Study, it can help you to identify future financial opportunities and set goals for your business. It’s free, easy and confidential.
Participate by June 30 to get a free copy.
“The Cost of Doing Business Study is a must. It lets you see how you are performing on key metrics versus your peers and where you can focus on improving.”
Andrew Blatnick | AAA Paint and Supply
YourNHPA.org/codb
Cost of Doing Business Study
Photo courtesy of @sarahbezansoninteriors. “This dresser was brightened up with Benjamin Moore's Woodlawn Blue. The fronts were freshened up
The Key to Diversity
Learn first steps you can take toward creating a diverse workplace at PDRmag.com/diverse-workplace
Diversity Pays
How Embracing Differences Improves the Workplace
There are many advantages to having a diverse workplace. Here’s what you can expect when your employees have a variety of backgrounds and perspectives.
Better Customer Service
People feel comfortable shopping in a place where the employees look like them. Practically speaking, employees understand the language and the culture of the people shopping there.
Improved Business Performance
Companies with inclusive cultures are twice as likely to meet or exceed financial targets and eight times as likely to achieve better business results
Source: Deloitte
Enhanced Creativity
Top Talent
When employees have a diverse set of backgrounds and experiences, they are likely to be more creative in solving problems and initiating innovation. results. workers.
A survey showed 76 percent of job seekers and employees say a diverse workplace is an important factor when evaluating job offers. Employers who don’t make an effort toward diversity could be missing out on quality worker
Source: 2020 Diversity and Inclusion Workplace Survey, GlassDoor
