Phase Eight and Hobbs owner hit by cyber-attack, as H&M probes separate hack claim

TFG London, the parent company of high-street brands Phase Eight and Hobbs, is grappling with a cybersecurity incident that disrupted online orders over the weekend, as H&M simultaneously investigates a separate hack claim. The attack, reported by BBC Technology, has left shoppers unable to complete purchases on two of Britain’s most recognisable fashion retailers and raised fresh questions about how UK retailers defend themselves against increasingly sophisticated digital threats. The company, which operates more than 600 stores across the UK and internationally, confirmed on Sunday evening that it had taken its e-commerce platforms offline as a precaution while investigating the breach.

Why it matters

For Manchester’s Market Street, London’s Oxford Street and the online shoppers who browse Phase Eight’s floral dresses and Hobbs’ tailored coats from flats across the UK, the incident was a stark reminder that a single breach can shut down the checkout experience for thousands of customers in minutes. BBC Technology noted that TFG London attributed the disruption to what it called a “cybersecurity incident,” without specifying whether customer data was exfiltrated. What is clear is that the attack hit at a critical moment: the autumn retail season, when British consumers are replacing winter coats and preparing for the party season. A successful ransomware deployment against household-name retailers would also set a worrying precedent for the thousands of smaller boutiques and independent designers that rely on the same third-party payment processors and logistics platforms. Prime Minister Andy Burnham’s government, already under pressure to strengthen national cyber defences, now faced a high-profile incident involving two quintessentially British brands that employ thousands of people across the UK.

What happens next

TFG London has not confirmed whether customer payment data was compromised, but the company’s apology to affected customers suggested that some level of database access was gained. The National Cyber Security Centre was expected to issue guidance to retailers within days, and MPs on the business committee were likely to summon TFG executives for questioning once the company had a clearer picture of the damage. H&M’s separate investigation, which the BBC reported was being treated as a precautionary review rather than a confirmed breach, may reveal whether the two incidents are linked. For now, shoppers hoping to complete autumn purchases online were being directed to call-centre queues or to visit physical stores, where point-of-sale systems appeared to remain unaffected. Customer service teams were overwhelmed with inquiries from people unable to track recent orders, and consumer watchdogs had already begun fielding complaints about the lack of real-time communication during the outage.

The incident also added urgency to ongoing parliamentary discussions about introducing mandatory breach disclosure rules for consumer-facing businesses. Under current UK law, companies that suffer a breach affecting personal data must report it to the Information Commissioner’s Office within 72 hours, but the threshold for what constitutes “personal data” in a retail context remained a grey area that campaigners hoped this incident would clarify.

Source: BBC Technology — Phase Eight and Hobbs owner hit by cyber-attack, as H&M probes separate hack claim