The UK arm of South African retail conglomerate The Foschini Group has confirmed a TFG London cyber attack affecting some of its IT systems, with Phase Eight, Hobbs and Whistles among the brands disrupted. Separately, fashion chain H&M says it is looking into a claim that it was targeted by a hacking group, as BBC News reports a spate of attacks on UK fashion retailers.
TFG London, the British subsidiary of The Foschini Group, which owns Phase Eight, Hobbs, Whistles, Inside Story and White Stuff, said it identified the incident on 11 October. ‘We are actively investigating and working with external cyber security specialists,’ the company told BBC News.
What we know about the TFG London incident
Stores are continuing to operate as normal, but some website functionality may be unavailable while the investigation is under way. TFG London told customers in an email, seen by news service PA, that it did not believe payment information had been affected. ‘As our investigation continues, we will be working to identify if any sensitive information related to our customers was impacted,’ the company said. It added that anyone whose personal information was found to be affected would be told directly, and that there was no need at this stage for customers to change their account login details.
According to IT Pro, TFG’s operations in Africa and Australia appear unaffected, as do two further brands it owns, Inside Story and White Stuff. The Independent also reported that customers who placed orders before 11 October were told their purchases would be processed and delivered as normal, though some delays were possible for orders placed after that date.
PA quoted Beverley Griffiths, a security and resilience academic at Bucks New University who holds a senior lectureship there, as saying the attack was ‘a clear sign that major brands are firmly in the crosshairs of cyber attackers’. She said that ‘no organisation is immune’, and that ‘the real test of resilience is how quickly a business can detect an incident, respond and recover while keeping its customers informed’.
Charlotte Wilson, head of enterprise at cyber-security firm Check Point, told the BBC that attacks on retailers were ‘starting to look rather like buses… you wait for one, and suddenly three come along at once’. While she said it was too early to establish how the TFG London breach occurred, or whether it was linked to other recent attacks, she added that ‘the retail industry has some serious questions to answer about how exposed its systems have become’.
H&M and the wider pattern of retail attacks
H&M said it became aware of claims circulating online about a potential breach attributed to a group called ShinyHunters, a hacking collective previously linked to attacks on Ticketmaster, Rockstar Games and the FBI. ‘We are aware of information circulating online regarding a potential cyber security incident and are currently investigating the claims,’ H&M told BBC News. ‘At this time, we have not found any indications that our data environment has been compromised,’ it added.
The two incidents follow a breach at Asos, where customers were informed via a push notification that the retailer had been hacked by a separate group. Cyber-security specialists told the BBC the use of an app notification as a form of ransom message was unprecedented. It later emerged that hackers had obtained more detailed personal data from Asos customers than the retailer initially disclosed, and an update was issued after cyber criminals told BBC News that the scope of the breach extended further than the ‘basic contact details’ Asos had previously said might have been accessed.
TFG London said it would provide further updates to customers as its investigation continues.
