TFG London – the UK subsidiary of South African retail group The Foschini Group and owner of Phase Eight, Hobbs and Whistles – has been hit by a cybersecurity incident affecting its IT systems, identified on Sunday October 11. The attack comes within days of ASOS confirming that an unauthorised party had accessed some personal data including names and contact details on October 6, and as H&M Group investigates claims by the cybercriminal group ShinyHunters that it was also targeted.

TFG London said there is “no reason to believe that payment information is at risk” and that its stores remain open and trading, though several IT systems remain unavailable and online orders placed from October 11 may be delayed. The company is working with external cybersecurity specialists and has reported the incident to the relevant UK authorities. Whether customer data has been compromised has not yet been established.

H&M’s situation is less settled: the Swedish group, which also owns COS, Arket and Monki, said it had found no evidence its data environment has been compromised, but confirmed it is investigating claims circulating online. ShinyHunters previously claimed involvement in the ASOS incident and demanded a $500,000 ransom following a 2024 attack on Ticketmaster, according to multiple media reports citing the group’s dark web posting. There is no established link between the TFG London and H&M incidents.

Timing is the threat – and why seasonal pressure changes the cover question

Multiple security analysts have noted that the retail sector is firmly in hackers’ sights. But what makes the current cluster of incidents particularly significant for the insurance market is not the technical sophistication of the attacks – it is the timing.

Claud Bilbao, VP of underwriting and distribution at Cowbell, told Insurance Business after the H&M hit: “Cyber incidents hitting major fashion retailers in a matter of days should be a wake-up call for the entire sector. There’s no evidence the attacks are connected, but cybercriminals don’t need to take a retailer offline to inflict serious damage. Stealing customer data, disrupting orders or undermining consumer confidence can be just as costly. And with Black Friday and Christmas approaching, attackers know that retailers face enormous pressure to keep trading. That commercial pressure can become a weapon in the hands of cybercriminals, particularly when they’re looking to extort a business.”

The seasonal timing matters for underwriters as much as for retailers. Cyber business interruption losses are disproportionately costly when they occur at peak trading periods – a disruption to online order systems in October or November, when retailers are building inventory and processing pre-Christmas orders, generates losses that a comparable incident in January would not. The extortion leverage is correspondingly higher, which is why Bilbao’s observation about commercial pressure as a weapon is operationally precise rather than merely rhetorical.

Black Friday is seen as a particularly large potential trigger. “In preparation, retailers need to look beyond their own security controls,” Ade Clewlow MBE, senior advisor at NCC Group, said in a statement issued to Insurance Business. “Third-party suppliers and connected systems can introduce vulnerabilities that criminals may exploit to gain access to a wider business. Organisations need to understand where their data is held, who can access it and whether their suppliers meet appropriate security standards. High profile retail companies need to have a better understanding of how threat actors target their sector, to better protect consumer data. Without knowing how the cyber criminals will conduct an attack, it’s almost impossible to implement the most appropriate defensive measures.”

The UK fashion retail cyber pattern

The current incidents sit in an established pattern of significant UK fashion and retail cyber events. Marks & Spencer was badly affected in 2025. ASOS confirmed a breach last week. And now Phase Eight, Hobbs and Whistles – household names in UK fashion retail – have been brought into the same wave within days of each other.

ShinyHunters is not a peripheral actor in this picture. The financially motivated group has demonstrated an ability to move across multiple high-profile retail and consumer targets within a short timeframe. For cyber underwriters with retail sector exposure, the attacker’s operational tempo means that retail cyber exposure should be evaluated not only by the individual company’s security posture but by the broader sector targeting environment in which it sits.

The three coverage questions every retail client needs answered before November

The specific risk that peak-season timing creates is not adequately addressed by a standard cyber policy review at renewal. Three questions are most immediately relevant for brokers with retail clients now.

First: does the cyber policy’s business interruption trigger respond to system unavailability even where no data exfiltration is confirmed? TFG London’s systems remain partially unavailable; the cause and scope of the breach are still under investigation. A policy that requires confirmed data loss before BI coverage attaches may leave a gap during exactly the period when losses are accruing.

Second: does the policy respond to reputational harm and customer confidence damage as a distinct head of loss, separate from direct data breach costs? Bilbao’s point about consumer confidence as a loss category reflects a coverage dimension that many retail cyber policies address inadequately.

Third: does the policy contain any provision for extortion payments or negotiation costs where a demand is made but payment is declined? The ShinyHunters pattern – ransom demands preceding data sale – suggests the extortion coverage question is live for any retailer in the current environment.

With Black Friday 10 weeks away and the UK retail sector now clearly in scope for multiple active threat actors, the renewal conversation for any retail client that has not reviewed its cyber coverage in the last 12 months is overdue.

Source link