The owner of the fashion brands Hobbs, Whistles and Phase Eight says it is investigating a cyber-security incident, and separately H&M is looking into a claim that it was attacked by a well-known hacking group.
What TFG London has said
TFG London, the UK arm of the retail conglomerate The Foschini Group, says it identified an incident on Sunday affecting some IT systems and "specifically impacting our Phase Eight, Hobbs, and Whistles brands". It is working with external cyber-security specialists.
Stores are operating normally, the company says, though some website functions may be unavailable.
In an email to customers seen by PA, TFG said it did not believe payment information had been affected, and that it was still working to identify whether any sensitive customer information was involved. Anyone affected would be told directly. It added: "We do not believe it is necessary to change your account login information at this time."
The H&M claim
On Monday it was reported that H&M was investigating a claimed hack by ShinyHunters — a group previously linked to attacks on the FBI, Rockstar Games and Ticketmaster.
"We are aware of information circulating online regarding a potential cyber security incident and are currently investigating the claims," H&M told the BBC. "At this time, we have not found any indications that our data environment has been compromised."
Two careful statements, and neither is a denial that something happened.
Why retail, and why now
Fashion retailers from Adidas to Alexander McQueen have been targeted by criminals seeking to extort money by threatening to publish customer data.
Beverley Griffiths of Bucks New University called it "a clear sign that major brands are firmly in the crosshairs", adding that "no organisation is immune, so the real test of resilience is how quickly a business can detect an incident, respond and recover while keeping its customers informed".
Charlotte Wilson of Check Point put it differently: attacks on retailers are "starting to look rather like buses... you wait for one, and suddenly three come along at once". She said the industry "has some serious questions to answer about how exposed its systems have become".
What it means in Bangladesh
The direct connection is the supply chain. The brands named here buy from Bangladeshi factories, and a retailer's systems hold purchase orders, costings, delivery schedules and supplier contacts. A breach at the buyer is a breach of the supplier's commercial information, and the supplier is rarely told.
That is worth stating plainly because the reporting never covers it. When a European retailer announces an incident, every statement is about *customer* data. No one asks whether the vendor portal was touched, and a factory in Gazipur has no way to find out.
There is a practical step for anyone running a factory that trades through a buyer's portal: treat those credentials as separately exposed. Use a password that exists nowhere else, enable two-factor authentication if the portal offers it, and assume any email referring to a real purchase order could be written by someone who has read the real purchase order.
The ShinyHunters name has appeared here before, in the FBI agents' data claim.
Source: BBC News, with customer-email details reported by PA.
