A confirmed customer-data incident at ASOS, disrupted IT systems at TFG London and an ongoing investigation at H&M highlight the growing importance of digital security and operational resilience in fashion retail.
Fashion retailers ASOS, H&M Group and The Foschini Group’s UK business have faced cybersecurity concerns in October, bringing renewed attention to the risks associated with customer data, digital platforms and business continuity.
Although the incidents differ in nature and severity, their close timing has raised questions about how fashion retailers protect their systems and respond when security is compromised.
ASOS confirmed that an unauthorised notification was sent to customers on 6 October after an attacker gained access to an employee account by impersonating a trusted contact to obtain login credentials. According to the retailer’s official update, the attacker accessed information on certain third-party platforms used to communicate with customers.
The investigation found that some personal information, including names and contact details, had been accessed. ASOS said payment-card information and account passwords were not accessed, and its website and app remained operational. Reuters reported that the company’s shares fell approximately 10% following the initial disclosure, reflecting the potential sensitivity of cybersecurity incidents for investors (Reuters).
Meanwhile, H&M Group said it was investigating online claims of a potential cybersecurity incident involving a limited amount of its data. Reports linked the claims to the cybercriminal group ShinyHunters. However, the Swedish retailer said it had found no indication that its data environment had been compromised at the time of its statement.
The distinction is important: H&M’s case remains an investigation into claims rather than a confirmed data breach. The development was reported by TheIndustry.fashion.
The Foschini Group (TFG), meanwhile, disclosed a cybersecurity incident affecting certain IT systems at its UK subsidiary, TFG London, on 11 October. The company’s SENS announcement identified Phase Eight, Hobbs and Whistles as affected brands.
TFG said stores remained open and trading, although several IT systems were unavailable. Its African and Australian operations, along with its Inside Story and White Stuff brands, were unaffected. The group engaged external cybersecurity specialists and notified the relevant UK authorities. Its investigation was continuing to establish whether personal or other sensitive information had been compromised.
Together, the incidents illustrate how cybersecurity risks can extend beyond data theft to customer trust, online services and day-to-day retail operations. They also demonstrate the importance of securing employee accounts and third-party platforms, as well as maintaining contingency plans when systems become unavailable.
The UK National Cyber Security Centre has advised ASOS customers to remain alert to suspicious communications and avoid clicking unexpected links (NCSC guidance).
There is currently no verified evidence linking the three incidents to a single coordinated attack. Nevertheless, the developments underline the need for fashion retailers to strengthen security controls, communicate transparently and respond quickly as investigations progress.
