Retail Cyberattack Backup & Recovery Lessons: TFG London, ASOS, H&M

What happened at TFG London

South African retail giant The Foschini Group confirmed its UK arm, TFG London, discovered a cybersecurity incident on 11 October 2026 affecting Hobbs, Phase Eight and Whistles. Two days on, several systems remained unavailable, stores stayed open, but website functions were patchy and, according to an email seen by The Telegraph, orders placed from the Sunday onward faced delays.

TFG said it activated its incident response and business continuity plans, engaged external specialists, and notified UK authorities. A third-party payment processor meant the company had, at the time of its statement, no reason to believe card data was at risk — though it is still investigating whether other customer information was exposed. White Stuff, Inside Story, and TFG's Africa and Australia operations were unaffected because they run on separate IT systems.

A pattern, not a one-off

TFG London is the third major UK-facing fashion retailer to report trouble in little over a week. ASOS confirmed an attacker impersonated a trusted contact to obtain an employee's login credentials, then used them to reach third-party platforms holding customer names and contact details. H&M, meanwhile, is reportedly investigating claims, first reported by The Times, that it was targeted by ShinyHunters involving a limited amount of company data, though it says it has found no evidence its systems were compromised.

There's no confirmed link between the three incidents. But the clustering matters to buyers: when one sector segment takes repeated hits in a short window, it usually signals a shared weakness — seasonal staffing, overloaded helpdesks around peak trading, or soft spots in third-party and identity controls — rather than three unrelated coincidences.

What the outage tells you about backup and recovery

TFG hasn't disclosed how attackers got in, whether ransomware was involved, or when systems will be fully restored. That silence is itself instructive: more than 48 hours after discovery, core brand websites were still degraded, which suggests either the incident is still being contained or that recovery from clean backups is taking longer than hoped.

If your own recovery plan can't demonstrate, in writing, how fast a customer-facing platform comes back after a similar hit, that's the gap to close first. A proper audit checks not just that backups exist, but that they're isolated from the production network, tested through full restore drills, and mapped against a recovery time objective your board has actually seen. Review your approach alongside managed detection and response so an intrusion is spotted in hours, not days.

Supply chain and identity: the ASOS lesson

The ASOS breach is a reminder that your weakest link may not be your own infrastructure at all. Impersonating a trusted contact to harvest one employee's credentials was enough to reach third-party platforms holding customer data — no malware, no exploit, just social engineering and an identity gap.

UK retailers running loyalty platforms, marketing tools, or fulfilment partners on shared logins should treat this as a prompt to review access controls and verify how quickly a compromised account can be detected and revoked. A email security checker is a quick way to spot the phishing and spoofing weaknesses attackers exploit first, and a zero trust approach limits how far one stolen credential can travel.

Business continuity is a trading decision, not just an IT one

TFG's statement that stores stayed open while websites degraded shows the brands made a deliberate continuity call: protect physical trading, accept digital friction. That's a reasonable trade-off if it's planned in advance — far riskier if it's improvised mid-incident.

Every hour of order delays and degraded checkout has a cost, and few retail boards have modelled it properly. Before renewing cyber insurance or signing off next year's IT budget, run the numbers on what a multi-day outage during peak season would actually cost versus the price of resilience investment, using something like an IT finance calculator to make the comparison concrete. Pair that with a wider cyber security review rather than treating backup, identity and detection as separate budget lines.

Five questions to ask before you're next

Use the TFG, ASOS and H&M incidents as a trigger for an internal audit, not just a news story to monitor.

• •Can you prove, from a recent test, how long a full restore from backup actually takes for your customer-facing platforms?
• •Are your backups genuinely isolated from the network an attacker who gets in would reach first?
• •Do you know which third-party platforms hold your customer data, and how fast a compromised employee account there would be noticed?
• •Does your business continuity plan specify what stays open and what degrades gracefully during an incident — agreed by the board, not improvised on the day?
• •Have you priced the cost of a multi-day outage against the cost of closing these gaps? If you haven't run that exercise, talk to a Servnet engineer before the next retailer on this list is you.