UK Retail Cyber Attacks: Asos, H&M Hit Protect Your Data
UK High Street Hit by Cyber Attack Wave: Asos, H&M and More What You Need to Do
If youve ordered clothes online in the UK this week, your personal data might be in the hands of criminals. Over the past few days, a string of UK retail cyber attacks has hit some of the countrys best-known brands Asos, H&M, Hobbs, Whistles and Phase Eight leaving millions of shoppers wondering whether their details are safe.
Heres whats happened so far, whos believed to be behind it, and most importantly the practical steps you should take right now.
What happened: a week of retail breaches
Asos confirms unauthorised access
It started with Asos. The online fashion giant told customers that an unauthorised party had gained access to some personal data, including names and contact details. Some shoppers first learned about it through a phone alert, and the attackers reportedly claimed that data storage firm Snowflake had been compromised.
Phase Eight, Hobbs and Whistles hit days later
Days after the Asos news broke, The Foschini Group (TFG) revealed that its UK arm, TFG London, had spotted a cybersecurity incident on Sunday, 11 October. The attack knocked out IT systems for three of its brands: Phase Eight, Hobbs and Whistles.
TFG said stores remain open as normal, but some website features may be unavailable while the investigation continues. The company has brought in external cybersecurity specialists and reported the incident to the relevant UK authorities.
Notably, TFG said there is currently no reason to believe that payment information is at risk though it added that the investigation is still establishing whether any personal or sensitive information was compromised. Its other brands, including White Stuff and Inside Story, run on separate systems and were not affected.
H&M investigates ShinyHunters claims
Meanwhile, H&M Group the worlds second-largest fashion retailer confirmed it is investigating claims that it was targeted by a cybercriminal group calling itself ShinyHunters. The company said it has no indication so far that its data environment has been compromised, but the investigation is ongoing.
Sources suggest the same group may also be behind the Asos attack, operating under the name Xuanye translated as Mysterious Splendour.
Who are ShinyHunters?
ShinyHunters is a financially motivated cybercriminal group known for large-scale data theft and extortion. Rather than encrypting systems like ransomware gangs, they typically steal databases and demand payment in exchange for not leaking them.
The group specialises in social engineering, AI-powered voice phishing and exploiting cloud service misconfigurations. Past claimed targets include Google, Microsoft and Ticketmaster. This week also saw the FBI arrest a Canadian cybersecurity expert in connection with the ShinyHunters investigation a sign of how seriously law enforcement is taking the group.
Was your data affected? How to check
With several investigations still open, the full picture isnt clear yet. But if youve shopped with Asos, Hobbs, Whistles or Phase Eight recently, assume your basic contact details could be exposed until proven otherwise.
- Check Have I Been Pwned enter your email at haveibeenpwned.com to see if it appears in known breach datasets.
- Watch for phishing expect convincing fake emails or texts pretending to be these retailers. Attackers may now have real names and order details to make scams believable.
- Monitor your accounts keep an eye on bank statements and any unfamiliar login alerts.
7 things to do right now to protect yourself
- Change your passwords on the affected retailers sites and anywhere else you reused the same password.
- Turn on two-factor authentication (2FA) wherever its offered, especially email and banking.
- Use a password manager so every account gets a unique, strong password.
- Be sceptical of unexpected messages about deliveries, refunds or security alerts from these brands.
- Monitor your credit if you suspect identity details were exposed.
- Update your devices a critical flaw in Atlassian Data Center products (CVE-2026-21589) is also being actively exploited this week.
- Back up important data good hygiene any week, essential during an active attack wave.
What retailers are required to do
Under UK data protection law, companies must notify the Information Commissioners Office (ICO) within 72 hours of becoming aware of a personal data breach, unless it poses no risk to individuals. Affected shoppers should also be informed directly without undue delay when theres a high risk to their rights.
If you dont hear from a retailer but believe you were affected, you can complain to the ICO or contact the company directly to ask what data of yours was involved.
FAQs
Was my payment card information stolen?
TFG London has said there is currently no reason to believe payment information is at risk. Asos described the accessed data as personal details like names and contact information. Investigations are ongoing, so keep monitoring your statements regardless.
What should I do if I shopped at Asos, Hobbs, Whistles or Phase Eight recently?
Change your password on those sites, enable 2FA, check haveibeenpwned.com, and be extra cautious about phishing emails or texts referencing your orders.
Who are ShinyHunters and why do they target retailers?
ShinyHunters is a cybercriminal group focused on stealing large customer databases and extorting companies. Retailers are attractive targets because they hold millions of customer records with names, emails, addresses and order histories.
Are the shops still open?
Yes. TFG London confirmed its stores are open and trading as normal; only some online features may be limited during the investigation. H&M has reported no disruption.
The bottom line
This weeks attacks are a reminder that the brands we shop with every day are prime targets and that our data is only as safe as their weakest link. You cant control a retailers security, but you can control your own response: unique passwords, 2FA, and a healthy suspicion of any message that seems slightly off.
Well update this article as the investigations develop.
