A breach a day: TFG joins H&M and Intermarché on the target list
TFG London identified a retail cybersecurity incident on Sunday, October 11, that knocked out IT systems supporting its Phase Eight, Hobbs and Whistles brands [1]. Its White Stuff and Inside Story labels, running on separate infrastructure, were unaffected [1].
Stores stayed open, but some website functions and order processing were disrupted. The retailer said it had "no reason to believe payment information is at risk" [1].
The same week, H&M Group confirmed it was investigating claims tied to ShinyHunters, a financially motivated group known for social engineering, phishing and exploiting cloud-service vulnerabilities. Reports linked the claim to the same actors behind a recent breach at ASOS [1][2]. H&M said it had "not found any indications that our data environment has been compromised" [1].
Overnight between October 11 and 12, a separate attack hit refrigeration control systems at Intermarché and Coopérative U stores in France, along with branches of Carrefour, Monoprix and E.Leclerc, spoiling stock and sparking fires [1].
| Incident | Identified | What was hit | Data confirmed stolen? |
|---|---|---|---|
| TFG London (Phase Eight, Hobbs, Whistles) | Oct 11 [1] | IT systems, online orders | Not yet established [1] |
| H&M Group | Reported Oct 12 [2] | Limited company data, per claim | No evidence found [1] |
| Intermarché / Coopérative U | Overnight Oct 11-12 [1] | Refrigeration control systems | No, physical/inventory damage [1] |
Retail cybersecurity pattern: the TFG breach lands a week after ASOS
The cluster traces back to October 6, when ASOS customers received pop-up messages claiming a group calling itself Xuanye Group had "fully compromised the Snowflake instance" tied to the retailer [1]. The same group also claimed responsibility for an attack on Air France-KLM [1]. Snowflake is a data storage provider, and the threat was to leak customer data unless ASOS engaged with the attackers [1].
“We are aware of information circulating online regarding a potential cyber security incident and are currently investigating the claims.”
Retail Gazette reported there is currently no confirmed evidence linking the TFG, ASOS and H&M incidents to one another, even as the pattern compounds reputational pressure across the sector [3].
The outlet also noted that the ASOS case showed how access to a single employee account can expose data held on third-party platforms, while the earlier disruption at Marks & Spencer showed how quickly an IT incident can turn into a prolonged trading problem [3]. TFG has not disclosed the cause of its breach, who may be responsible, or when normal IT operations will resume [3].
Does paying a ransom actually stop further attacks?
No. Data cited by InternetRetailing shows only 14% of organizations targeted by ransomware paid up in 2025, according to cyber-insurance firm Coalition, and paying does not guarantee a clean outcome [1]. Among U.S. ransomware victims who did pay, 68% were hit by a second attack within six months of the first, per a report cited from SQ Magazine [1].
That pattern matters for retailers weighing a quiet payout against a public breach disclosure during the run-up to peak trading. A payment buys neither certainty nor a lasting reprieve from repeat targeting.
When hackers skip data theft for physical disruption
The Intermarché and Coopérative U incident did not involve stolen data: attackers instead manipulated refrigeration controls across roughly 250 combined stores, forcing retailers to discard spoiled stock and respond to fires, with losses reported in the hundreds of thousands of pounds [1]. That shifts the threat model from customer-data exposure to physical, inventory-level damage.
It is not an isolated case of a cyberattack reaching into physical operations. Food distribution giant United Natural Foods disclosed a cyberattack that forced it to shut down its ordering network, and weeks later was still restoring systems used by more than 30,000 stores across the U.S. and Canada, with Whole Foods, a major customer relying on UNFI as its primary distributor, reporting shelf shortages as a direct result [5].
Together, the two cases show that connected industrial and logistics equipment, not just e-commerce front ends, is now squarely inside the retail attack surface.
Regulators are catching up to AI-accelerated attacks
The UK government said on October 12 that it was preparing Britain for "serious incidents" involving AI agents and indicated it may legislate to protect critical infrastructure from AI-powered cyberthreats [1].
That announcement landed the same day as the Intermarché disclosure, underlining how a sector that accounts for just 3.6% of all reported attacks can still carry outsized consequences when the target is food supply or payment infrastructure rather than a single retailer's website [1].
What commerce and IT leaders should prioritize before peak season
The common thread across TFG, H&M, ASOS and Intermarché is that the entry point is rarely the core commerce platform itself. It is a third-party credential, a connected device, or a vendor system sitting just outside it.
Ahead of peak trading, that points to a few concrete priorities:
None of the retailers hit this week have confirmed the root cause of their incidents, and TFG, H&M and Intermarché are all still investigating. What is already clear is that the systems worth hardening extend well beyond the checkout page.
- Re-verify access controls on every third-party and cloud platform connected to customer or operational data, not only the commerce storefront.
- Extend incident response and business continuity plans to operational technology, including refrigeration, warehouse and point-of-sale control systems, not just IT and web systems.
- Pressure-test supplier and logistics-partner cyber resilience now, since a breach anywhere in that chain can halt fulfillment regardless of platform uptime.
- Prepare customer communication protocols in advance, so a disclosure can go out within hours rather than days once an incident is confirmed.
- Treat a ransom payment as a cost, not a fix, given how often targeted organizations are attacked again shortly after paying.
Sources
- [1]InternetRetailing, TFG, H&M and InterMarché all targeted by cybercriminals as threat to retail rockets — internetretailing.net
- [2]Retail Gazette, H&M becomes latest retailer to investigate cyber attack — retailgazette.co.uk
- [3]Retail Gazette, Hobbs, Whistles and Phase Eight hit by cyber incident as retailers face fresh attacks — retailgazette.co.uk
- [4]Retail Week, H&M investigates cyberattack claims — retail-week.com
- [5]TechCrunch, As grocery shortages persist, UNFI says it's recovering from cyberattack — techcrunch.com
