TFG, the parent company of fashion brands Whistles, Hobbs and Phase Eight, is the latest retailer to suffer a cyber-attack.
South African retail group The Foshini Group (TFG) said it became aware that some of its IT systems had been breached on Sunday 11 October, affecting its London operations, specifically its Phase Eight, Whistles and Hobbs brands. Other brands, including The White Stuff, were not affected.
It said that it has “no reason to believe payment information is at risk” and it has reported the breach to the relevant authorities.
Stores remain open, but some website functions and order processing have been disrupted.
H&M investigates claims
H&M is also investigating claims it was targeted by a group of cybercriminals known as Shinyhunters. “We are aware of information circulating online regarding a potential cyber security incident and are currently investigating the claims,” H&M told BBC News in a statement.
“At this time, we have not found any indications that our data environment has been compromised.”
And yesterday (12 October) cyberhackers turned up the heat in fridges at hundreds of Intermarché shops and Coopérative U outlets in France, meaning hundreds of thousands of pounds worth of spoiled food had to be thrown away.
ASOS customers received notification from hackers
The cyber-attacks come a week after online fashion retailer ASOS was targeted by cyber-criminals. Thousands of its mobile app users and customers received a pop-up message purporting to be from hackers, stating that they have “fully compromised the Snowflake instance” and warning ASOS to engage with them or they would leak it.
Snowflake is a data storage company, and the hackers appeared to be threatening to leak ASOS customer data. ASOS is continuing to investigate the incident, but says that it has not affected customer password or credit card information.
The hackers claiming to be behind the incident call themselves Xuanye Group, and also claim responsibility for a recent cyberattack on airline group Air France-KLM.
Xuanye – which translates to “mysterious splendour” – are a newly-emerged group of cybercriminals looking to extort money using a highly-visible form of corporate blackmail. They used AI to gain access to ASOS customer data via Snowlake, and reportedly gave ASOS a two-week deadline to pay a ransom or they would leak the data.
It is not known whether any of the above firms have paid a ransom, but many organisations simply quietly pay up. Around 14% of firms targeted paid the ransom in 2025, according to data from cyber-insurance firm Coalition. However, paying the ransom does not necessarily guarantee full return of data or safety from another attack – in the US, 68% of ransomware victims in 2025 experienced a second attack within six months of the first, according to a report in SQ Magazine.
Growing risk to critical infrastructure
The SQ Magazine report highlighted that the retail sector currently sees 3.6% of attacks – but with a growing risk that bad actors may use cybercrime to cause significant disruption in the UK, the government has indicated that it may legislate to protect critical infrastructure from artificial intelligence-powered cyberthreats. It stated on 12 October that it was trying to prepare Britain for “serious incidents” involving AI agents.
The Intermarché incident shows that cybercrime could potentially threaten food security alongside other critical infrastructure.
For online or omnichannel retailers, the threat is very real. AI has made it easier than ever for cybercriminals to breach secure systems and steal data. With cybercrime a growing threat, and criminal demands increasing along with the attacks, having a clear risk management and contingency plan in place is a necessity.
Working together
It is also important for the sector to work together to mitigate the risk, as Samuel Hassine, CEO and co-founder of threat management platform Filigran explains: “When one retailer’s breach becomes the next retailer’s investigation within days, the real exposure is the shared supply chain of credentials, platforms and suppliers that the whole sector runs on. Attackers do not need a new intrusion for each brand; they reuse stolen logins, exploit the same third-party integrations and move at a pace that monthly reviews cannot follow.
He added: “Retail security leaders should start from what is already out there: which of their credentials are circulating, which partners hold access to customer data, and which exposed APIs still accept a valid password without a second check. Then test those paths the way the attackers in the news operate, and fix what fails before an allegation becomes a loss. The sector will only get ahead of this by sharing what it learns from each incident, quickly and openly.”
Stay informed
Our editor carefully curates two newsletters a week filled with up-to-date news, analysis and research. Click here to subscribe to the FREE newsletter sent straight to your inbox. Why not follow us on LinkedIn to receive the latest updates on our research and analysis?
