TFG London, the UK arm of retail group The Foschini Group and owner of Phase Eight, Hobbs and Whistles, identified a cyber security incident on Sunday 12 October 2026 affecting some of its IT systems and “specifically impacting our Phase Eight, Hobbs, and Whistles brands”. Its stores are trading normally, though some website capabilities may be unavailable. Separately, H&M has confirmed it is investigating a claim of a hack by the criminal group ShinyHunters, while saying it has “not found any indications that our data environment has been compromised”. Both follow the ASOS breach disclosed the previous week — in which, it has since emerged, the attackers obtained more detailed personal information than ASOS initially suggested.
Charlotte Wilson of Check Point put the pattern memorably: retail attacks are “starting to look rather like buses… you wait for one, and suddenly three come along at once”. The more useful observation for UK businesses came from Beverley Griffiths of Bucks New University: “no organisation is immune, so the real test of resilience is how quickly a business can detect an incident, respond and recover while keeping its customers informed.” That last clause — while keeping its customers informed — is where the past fortnight offers its sharpest lesson. ASOS’s early description of what had been accessed later turned out to be incomplete, after BBC News told the retailer it had been contacted by the attackers directly. That is not unusual in an investigation’s first days, and it is not necessarily anyone’s fault. But it shows that the first thing a business tells its customers will be judged against what emerges later, and that the wording of an early statement matters almost as much as the technical response behind it.
What each company has said
TFG London said it identified a cyber security incident on Sunday 12 October affecting some IT systems and specifically impacting its Phase Eight, Hobbs and Whistles brands. Its stores are operating as normal, but some website capabilities may be unavailable. It said it does not believe customer payment information was affected, and in an email to customers said it does not believe it is necessary to change account login details at this time. Its investigation is continuing to determine whether any customer personal information was affected, and it said anyone impacted would be contacted directly.
That statement is worth reading closely, because it is careful in a way that helps everyone. It says what the company believes about payment data and login details, and it says plainly that the question of personal information is still open. It does not claim more certainty than an investigation two days old can support, and it tells customers how they will hear if they are affected. Whatever the investigation finds, that structure leaves the company room to update without contradicting itself.
H&M’s position is different in kind. It is investigating a claim by ShinyHunters, a group previously linked to attacks on the FBI, Rockstar Games and Ticketmaster, and says it has “not found any indications that our data environment has been compromised” so far. Criminal groups frequently make claims to create pressure, and some prove substantially true while others are exaggerated or false. Until H&M’s investigation concludes, the accurate description is a claim under investigation with no compromise found to date — not a breach.
The ASOS development is the reason the other two statements deserve attention. In the week after its push–notification incident, it emerged that the attackers had obtained more detailed personal information than ASOS initially suggested. That came to light after BBC News told the retailer it had been contacted by the attackers directly. The detail of what was obtained is ASOS’s to confirm; the general point is that an early description of a breach is a snapshot of an investigation in progress, and readers — customers, journalists, regulators — will compare it with what comes later.
The wider context is that fashion retail has been a repeated target. Other major brands including Adidas and Alexander McQueen have previously been targeted by criminals seeking to extort money by threatening to release stolen customer data. Griffiths called the recent cluster “a clear sign that major brands are firmly in the crosshairs of cyber attackers”, and Wilson said “the retail industry has some serious questions to answer about how exposed its systems have become”.
In the first hours of an incident there is enormous pressure to reassure customers, and the natural instinct is to say that the damage is limited. The difficulty is that nobody knows the full extent of a breach that early, and attackers sometimes hold information the victim has not yet found — occasionally telling journalists before they tell the company. An early statement that turns out to have understated the damage costs far more trust than an early statement that was candid about uncertainty. The safer structure is the one TFG’s email followed: what we believe so far, what we are still investigating, and how and when you will hear more. That wording does not alarm anyone unnecessarily, and it does not need to be retracted if the picture changes. For any business, the moment to decide how you would phrase that statement is before you need it, not while an investigation is under way and every hour feels urgent.
How the retail incidents have unfolded
The chronology below follows what has been reported. Earlier incidents mentioned in the coverage are included without dates where none were given.
Two features of that timeline are worth taking away. The first is the speed of the cluster: three household–name retailers in the news inside roughly a week. When peers in your own sector are being hit, the most useful immediate step is to check whether you share anything with them — suppliers, software platforms, service providers — because a common dependency is one of the commonest reasons attacks cluster. The second is the way the ASOS story changed after its first telling. That is a reminder that an incident has two timelines running in parallel: the technical one inside the business, and the public one that customers and journalists follow, and the second does not wait for the first to finish.
What shortens the path from intrusion to recovery
Griffiths’ test of resilience — detect, respond, recover, keep customers informed — is a useful frame for ranking controls. The chart below is an indicative planning model — not measured data — showing how much each typically contributes to getting a UK retailer or SME through an incident quickly and with customer trust intact.
The second bar reflects a detail in TFG’s timeline that is easy to pass over: the incident was identified on a Sunday. Attackers often choose evenings and weekends because response is slower, and a business whose alerts go to an inbox nobody reads until Monday has given away a day or two. Monitoring that reaches a person out of hours — whether in–house or through a managed provider — is one of the most direct ways to shorten the detection part of Griffiths’ test.
The sixth bar connects to another detail: TFG’s stores kept trading while some website capabilities were unavailable. We do not know how TFG’s systems are arranged, and should not infer it. But the general principle is sound: a business whose tills, website and back office are separated can lose one without losing all three, which turns an incident from a shutdown into a partial disruption. That separation is far easier to design in advance than to create during an incident.
One question still open, and why it is the one that matters
TFG’s customer email addressed three categories of data. Sort them by the company’s current position.
On payment information, TFG says it does not believe it was affected. On login details, it says it does not believe customers need to change them at this time. On personal information, it says the investigation is continuing and that anyone affected will be contacted. That is an honest division, and it is also a reminder of where risk tends to sit in the days after an incident. The categories a company can speak to early are often the ones it can check quickly. The category still being investigated is, by definition, the one where the picture can still change.
That is precisely what happened at ASOS. The early statement there addressed basic personal information, and it later emerged that more detailed personal information had been obtained. Nothing in TFG’s statement suggests the same outcome, and it would be wrong to imply that it will. The general lesson is about customers rather than any one company: when a business says the personal–information question is still open, the sensible response is to treat it as open — watching for unexpected messages that reference the incident, and being wary of anything asking for details or offering compensation through a link.
For businesses, the lesson runs the other way. If your first statement has to leave a category open, say so explicitly, as TFG did, and commit to a way of telling people when it closes. A clear “we do not yet know, and we will tell you” is far more durable than a reassurance that has to be withdrawn.
Where UK businesses are exposed
The rows below reflect where incident–readiness gaps typically sit in a UK SME, framed around Griffiths’ four tests — detect, respond, recover and keep customers informed — with badges indicating how much attention each usually needs.
The seventh row is the one this cluster of incidents makes most relevant. When three retailers are hit in quick succession, it is reasonable to ask whether they share something — a software platform, a service provider, a common weakness in a widely used product. Nothing published so far says these incidents are connected, and they may not be. But a business in the same sector does not need to wait for confirmation to check its own position: which platforms do we share with the companies in the news, have those suppliers said anything, and would we notice if the same thing were happening to us?
The eighth row reflects a twist that has now appeared twice in a fortnight. In the ASOS case, attackers sent messages to customers and contacted journalists; the BBC told ASOS it had been approached by them directly. A business that has only planned for a private, internal incident may find its first awareness of the full picture comes from a reporter. Having agreed in advance who speaks to the media, what they can say, and how quickly a statement can be approved is a small piece of preparation that makes a large difference when that call arrives.
What getting incident–ready costs
The bands below are indicative planning figures for UK businesses improving their ability to detect, respond to, recover from and communicate about an incident — not quotes.
| Business profile | Typical scope | Indicative cost | What you get for it |
|---|---|---|---|
| Independent shop or small online retailer | Independent, tested backup of shop and customer data, a list of platforms holding customer data, a one–page incident plan and a drafted holding statement | £400 – £2,000 | The ability to recover without paying anyone, and to tell customers something accurate within hours |
| SME, 10 – 50 staff | Managed monitoring with out–of–hours alerting, separation of key systems, agreed incident roles, pre–approved customer and media statements | £3,000 – £15,000 | Faster detection, an incident contained to part of the business, and communications that do not need to be retracted |
| Multi–brand or multi–site retailer | Brand– and channel–level separation, supplier and platform inventory, tabletop exercise including a media approach, recovery objectives per channel | £15,000 – £60,000 | Stores, websites and brands that can fail independently, and a rehearsed response for when attackers go public first |
| Business supplying retail or holding large customer databases | All of the above plus extortion response planning, data minimisation review, and assurance evidence for clients asking about your readiness | £20,000 – £80,000 | Less data at risk in the first place, and a defensible answer when a client asks what would happen if you were next |
| Any business, immediately | Restore one file from backup, check who receives security alerts at the weekend, and write a three–line holding statement | £0 | An honest view of how you would fare against Griffiths’ four tests |
The bottom row is free and is the right place to start. The holding statement in particular takes ten minutes and pays for itself the first time it is needed. Three lines are enough: what has happened as far as you currently know, what you are still investigating, and when and how customers will hear more. Written calmly in advance, it is far better than anything written in the first hour of a real incident.
Two ways to handle the first 48 hours
Reactive posture
How incidents often unfold without preparation
- The incident is noticed on Monday morning because weekend alerts went to an unread inbox
- Nobody is sure who can authorise taking the website or tills offline
- The first customer statement is drafted in a hurry and leans towards reassurance
- Backups turn out to be incomplete, outdated or reachable by the same compromised account
- A journalist calls with details the business has not yet found
- The early statement has to be revised, and customers notice
- Incidents at sector peers are read as news rather than as a prompt to check
Proactive posture
Where Cloudswitched managed IT support takes you
- Monitoring that reaches a person at any hour, so detection does not wait for Monday
- Incident roles agreed in advance, including who decides to isolate a system
- A pre–drafted statement that separates what is known from what is still under investigation
- Tested backups held behind separate credentials, ready to restore
- A named spokesperson and an agreed line if attackers or journalists go public first
- Updates that add detail rather than contradict earlier statements
- A routine for checking shared platforms and suppliers when a peer is hit
The two columns describe the same incident handled by two different organisations. The technical intrusion might be identical. What differs is how quickly it is noticed, how cleanly it is contained, how fast normal service returns, and whether customers come away trusting the business more or less. Every item on the right is preparation that costs little and cannot be improvised once an incident has begun, which is exactly why it is worth doing in a quiet week.
The single most useful preparation for the communication part of an incident takes ten minutes. Write three sentences, leaving blanks for the specifics. First, what you know: “On [date] we identified a cyber security incident affecting [systems]. We acted immediately to contain it.” Second, what you are still establishing: “Our investigation is continuing to determine whether any customer information was affected. Based on what we know so far, we do not believe [category] was affected.” Only include a category you are genuinely confident about, and say plainly when the rest is still open. Third, what happens next: “Anyone affected will be contacted directly, and we will update this page by [time].” Then agree who can approve it and where it would be published if your normal channels were affected. That structure — the one TFG’s customer email broadly followed — lets you say something accurate quickly and add detail later without contradicting yourself.
What the cluster means for UK businesses beyond fashion
It would be easy to read this as a fashion–retail story. The sector is plainly a focus at the moment, with large customer databases, sensitive brands and a history of extortion attempts against names like Adidas and Alexander McQueen. But Griffiths’ framing — that no organisation is immune and the real test is detection, response, recovery and communication — applies to every business that holds customer data, whatever it sells.
Wilson’s point that the retail industry has “serious questions to answer about how exposed its systems have become” generalises too. Retail systems have become sprawling: e–commerce platforms, marketing and messaging tools, loyalty schemes, payment providers, warehouse and logistics systems, each with its own accounts, integrations and suppliers. Many small businesses have a smaller version of the same sprawl, accumulated one convenient tool at a time, and few have a single list of what holds customer data and who can reach it. That list is the foundation for every part of Griffiths’ test.
The supply chain angle deserves a final note. When several organisations in one sector are hit in quick succession, attackers may be exploiting something they share. Nothing reported so far establishes a link between ASOS, TFG and the claim against H&M, and it would be wrong to suggest one. But businesses that supply retailers, or that use the same kinds of platforms, should treat a cluster like this as a cue to review their own exposure rather than waiting to find out whether there was a common thread.
For organisations pursuing Cyber Essentials, the scheme covers the preventive foundations — secure configuration, access control, patching, malware protection and boundary firewalls — that make many attacks harder. What it does not cover on its own is the response layer this cluster highlights: out–of–hours detection, recovery from independent backups, and communication under uncertainty. Certification is a strong base, and incident readiness is the part to build on top of it.
The story at a glance
| Item | Detail |
|---|---|
| TFG London | UK arm of The Foschini Group; identified an incident on Sunday 12 October 2026 affecting some IT systems |
| Brands affected | Phase Eight, Hobbs and Whistles |
| Operational impact | Stores operating as normal; some website capabilities may be unavailable |
| Payment data | TFG does not believe customer payment information was affected |
| Login details | TFG told customers it does not believe it is necessary to change login details at this time |
| Personal information | Still under investigation; anyone affected will be contacted directly |
| H&M | Investigating a hack claim by ShinyHunters; has “not found any indications that our data environment has been compromised” |
| ShinyHunters | Previously linked to attacks on the FBI, Rockstar Games and Ticketmaster |
| ASOS update | Attackers obtained more detailed personal information than ASOS initially suggested, after BBC News told ASOS it had been contacted by the attackers |
| Earlier targets | Adidas and Alexander McQueen have previously faced extortion attempts over stolen customer data |
| Expert view on resilience | Beverley Griffiths, Bucks New University: the real test is how quickly a business can detect, respond and recover while keeping customers informed |
| Expert view on the pattern | Charlotte Wilson, Check Point: retail attacks look “rather like buses”; the industry has questions to answer about its exposure |
| Are the incidents linked? | Nothing reported establishes a connection |
| Communications lesson | Separate what you know from what you are still investigating, so early statements do not need retracting |
| Free first step | Restore a file from backup, check who sees weekend alerts, and draft a three–line holding statement |
This story connects to several we have covered recently. The ASOS push–notification breach is the first of this month’s retail incidents, and the developments since are a case study in how an early account of a breach can change. The UK AI minister’s warning that a breach is “likely, if not inevitable” makes the same assume–breach argument at national level. Mastercard’s offline payments rollout is about keeping tills working when other systems fail. The Kiteworks shutdown warning named ShinyHunters as a rival of the Cl0p group, which targets managed file transfer platforms. The Chromium lookalike–domain research is relevant to the follow–on phishing that often accompanies a well–publicised breach. And the Supreme Court hearing on data protection claims is a reminder of the legal exposure that follows customer data loss.
Would you know on Sunday, or find out on Monday?
TFG London identified its incident on a Sunday. Many small businesses would not have noticed until the working week began. Cloudswitched provides managed IT support for UK businesses that covers the whole of the resilience test: monitoring that reaches a person out of hours, backups held independently and tested by restoring, systems separated so one failure does not stop everything, and an incident plan with a holding statement ready before it is needed — so that if the bus stops at your door, you already know what to say and what to do.
Talk to us about Managed IT SupportFrequently asked questions
No organisation is immune — so be ready to recover
The retailers in the news this month are large organisations with substantial security teams, and they were still hit. For a small business, the realistic goal is not to be untouchable but to notice quickly, contain the damage, restore from a copy that survived, and tell customers the truth in a way that holds up as the picture develops. Cloudswitched’s managed IT support is built around that test: out–of–hours monitoring, tested backups, sensible separation of systems, and an incident plan and holding statement prepared in a quiet week rather than written in a crisis.
Talk to us about Managed IT Support
Cloudswitched
London-based managed IT services provider offering support, cloud solutions and cybersecurity for SMEs.
