The NCSC urges firms to check IT help desk "password reset processes" as hackers target retailers.