#retailcybersecurity

Read Time:3 Minute, 12 Second

Stores Stay Open, But Systems Go DownThe Foschini Group (TFG), the South African retail conglomerate, has confirmed that a cyberattack disrupted IT systems supporting three of its UK fashion brands: Phase Eight, Hobbs, and Whistles. The company detected the intrusion on October 11, 2026, and disclosed it to shareholders two days later. According to TFG’s shareholder statement, physical stores for the affected brands have continued trading throughout the disruption, even as several backend systems remain unavailable.

Two other UK brands under TFG’s umbrella, Inside Story and White Stuff, were not affected by the incident. TFG’s operations in Africa and Australia also escaped impact entirely, because those regions run on separate IT infrastructure from the UK business. The confirmed disruption therefore appears limited to part of TFG’s UK retail operations rather than the group’s global footprint.

Incident Response UnderwayTFG says it activated its incident response and business continuity plans as soon as the attack was discovered, and has brought in external cybersecurity specialists to help contain it. UK regulators and other relevant authorities have also been notified. The company’s investigation into whether personal or other sensitive customer information was accessed or stolen is still ongoing.

What Customers Can ExpectFor shoppers, the practical impact includes some unavailable website functions and delays affecting orders placed on or after October 11. TFG has asked customers not to resubmit any delayed orders, and says purchases made before that date should process and ship normally.

On the question of payment security, TFG told customers that a third-party provider handles its payment processing, and that based on its investigation so far, the company has “no reason to believe that payment information is at risk.” Importantly, TFG has not ruled out that other categories of customer data may have been exposed, and says it will directly notify any customers found to be affected once its investigation concludes.

Key Details Still UndisclosedTFG has not publicly identified who is responsible for the attack, how the attackers gained initial access, or whether ransomware played a role. The company has also not given a timeline for when disrupted systems will be fully restored. Without more technical detail, it remains unclear exactly which applications were affected across the three brands or how access was shared, or isolated, between them.

Not TFG’s First Brush With Disruption This YearThe company’s June financial results referenced an earlier incident affecting a key online concession partner, one of several pressures weighing on its UK business, a portfolio that saw adjusted operating profit fall 65.4%, excluding brand impairment and acquisition costs. That earlier figure reflects broader financial headwinds and should not be mistaken for the cost of October’s attack specifically.

Part of a Difficult Year for UK RetailTFG’s disclosure adds to a string of high-profile cyber incidents affecting UK retailers in 2026, including the Marks & Spencer attack that disrupted payment and click-and-collect services, and a supplier-side data breach affecting Harrods customers. There is no indication the TFG incident is connected to either of those cases, but the pattern underscores how attractive retail IT environments, with their mix of point-of-sale systems, e-commerce platforms, and third-party integrations, have become for attackers.

What Comes NextFor now, the central open questions are how attackers got in, what data, if any, was taken, and when TFG’s UK brands can fully restore normal operations. Security researchers note that visibility gaps like these are common in the early days of an incident response, and that alerts alone often cannot reconstruct a full attack timeline without deeper forensic work.

Customers of Phase Eight, Hobbs, and Whistles should watch for direct communication from TFG regarding their own data.

Treat unsolicited messages referencing the incident, especially those asking for account or payment details, with caution.

Expect possible delays on orders placed on or after October 11 and avoid resubmitting them.

Read Time:3 Minute, 28 Second

Dutch-based retail giant Ahold Delhaize confirmed on October 12, 2026, that it had proactively shut down parts of its network after discovering what it described only as “a security issue.” The announcement, posted to the company’s newsroom, offered few technical details, but the operational fallout was immediate and visible across several of the company’s grocery brands on both sides of the Atlantic.

Ahold Delhaize, headquartered in Zaandam, framed the shutdown as a precaution rather than confirmation of a specific attack. “Protecting our infrastructure in the best interest of our customers, associates and partners is a top priority,” the company said, apologizing for the disruption while declining to name an attacker, describe how the incident began, or confirm whether any customer data was accessed.

Albert Heijn Customers Feel the Pinch FirstThe most visible impact landed on Albert Heijn, the Netherlands’ largest supermarket chain and an Ahold Delhaize flagship brand. According to Dutch outlet DutchNews, the Albert Heijn website, mobile app, and home delivery service all went dark after portions of its IT systems were deliberately switched off. Sister brands Etos, a drugstore chain, and Gall & Zall, Delhaize’s wine and liquor retailer, reported their own disruptions, with customer service and logistics systems reportedly affected as well.

Physical Albert Heijn stores stayed open throughout, and checkout systems kept functioning, but the digital side of the shopping experience took a visible hit:

Personal discounts and app-linked loyalty savings were paused

Online ordering and scheduled home deliveries became unavailable

Electronic shelf labels in some stores continued displaying the previous week’s promotional pricing, meaning shoppers could see one price on the shelf and a different one at checkout

Disruption Crosses the AtlanticAhold Delhaize’s reach extends well beyond the Netherlands, and the incident’s effects weren’t confined to Dutch shoppers. Trade publication Progressive Grocer reported that websites belonging to several of the company’s American grocery brands, including Food Lion, The Giant Company, Giant Food, Hannaford, and Stop & Shop, were unreachable at the time of its reporting. As with the Dutch operations, Ahold Delhaize maintained that physical stores across its US footprint remained open and operational even as online services faltered.

What Remains UnknownPerhaps the most notable thing about Ahold Delhaize’s disclosure is what it doesn’t say. The company has not confirmed ransomware, has not said whether any systems were encrypted, and has not indicated whether customer or employee data was accessed or exfiltrated. Its own language, that it was taking systems offline “to help protect them,” describes a defensive response but stops well short of identifying what it was defending against.

That ambiguity means outside observers should be cautious about jumping to conclusions. Taking systems offline proactively is a standard incident-response move used in scenarios ranging from a detected intrusion attempt to a full-blown ransomware encryption event, and the breadth of this shutdown, spanning multiple brands and countries, suggests the company judged the risk serious enough to warrant broad precautionary isolation rather than a narrow, surgical response.

Part of a Recurring Pattern in RetailLarge retailers taking systems offline after detecting suspicious activity has become a familiar pattern. Distributor United Natural Foods shut down systems after a cyberattack in June 2025 that disrupted its ability to fulfill and deliver orders, and Victoria’s Secret took its website offline following a security incident the previous month while keeping its physical stores running. Those cases don’t establish any connection to Ahold Delhaize’s current incident, but they illustrate how often retail and grocery operators are finding themselves forced into this same defensive playbook, where protecting back-end systems temporarily outweighs the cost of disrupted digital services.

What Customers and Watchers Should Expect NextFor now, Ahold Delhaize customers face reduced access to online shopping, delivery scheduling, and loyalty discounts rather than any disruption to in-person grocery shopping. The company has not published a restoration timeline or indicated when a fuller account of the incident, including its cause and whether any data was compromised, might be released. Until that information surfaces, both the scope of the breach and the attacker’s identity, if there is one, remain open questions that security researchers and affected customers will be watching closely.

Read Time:4 Minute, 1 Second

Shoppers who use the ASOS mobile app got an unwelcome surprise on the morning of October 6, 2026, when a push notification appeared on their phones under the blunt heading “ASOS HACKED.” The message was not from ASOS marketing — it was planted by an attacker who had found a way into the retailer’s customer-messaging infrastructure, and it set off a scramble inside the company to figure out exactly what had actually been touched.

A Notification Channel Turned Into a MegaphoneAccording to details that have emerged since the incident, the rogue notification was addressed directly to ASOS’s data protection officer and IT staff, demanding they “engage” with the attackers or risk having stolen data leaked. It included a link to a Telegram channel and asserted that the group had “fully compromised” ASOS’s Snowflake environment, the cloud data platform many large retailers use to warehouse customer and sales information.

ASOS has confirmed that something real did happen, but it has been careful to separate confirmed fact from the attacker’s own claims. The company says it is “investigating unauthorised activity involving third-party platforms that we use to communicate with customers” and that it immediately cut off access to the notification system once the rogue message was spotted. Beyond that, ASOS has only confirmed an “unauthorised customer notification” — not a verified breach of its Snowflake instance.

What Data Might Be Exposed — and What Probably Isn’tASOS has said that basic personal details, such as customer names and contact information, may have been accessed through the compromised notification platform. Importantly, the retailer states it does not believe payment card numbers or account passwords were affected by this particular incident. That is a meaningfully different exposure profile than a full database theft would represent, assuming the assessment holds up under further investigation.

Security researchers who reviewed the incident have urged caution about taking the attacker’s framing at face value. A spokesperson from Check Point told reporters that the group behind the message may simply be trying to pressure and embarrass ASOS into contact, rather than demonstrating genuine access to backend systems. Gaining control of a third-party notification tool does not, by itself, prove an attacker also reached ASOS’s cloud data warehouse, payment systems, or core retail network — those would typically require separate footholds.

Not ASOS’s First Rodeo This YearThis is the second publicly disclosed security incident to hit ASOS in a matter of months. Back in late July 2026, the company confirmed that customer accounts had been accessed using login credentials obtained from outside the company — a classic credential-stuffing attack, where criminals reuse username and password combinations leaked from unrelated breaches to try their luck against other sites. That episode, detected on July 28 and confirmed the next day, reportedly exposed names, addresses, phone numbers, dates of birth, and partial card details such as expiration dates and the last four digits of payment cards.

ASOS responded to the July incident by locking affected accounts, forcing password resets, and blocking or reversing suspicious transactions. There is no confirmed link between that earlier credential-stuffing wave and this month’s notification-platform compromise, but the back-to-back nature of the incidents has put additional scrutiny on the retailer’s third-party vendor relationships and its broader security posture.

Market and Customer FalloutThe financial market reaction was swift: ASOS shares reportedly fell more than 11%, with some intraday trading showing declines approaching 13%, as the news of a public “hacked” notification spread faster than the company’s own clarifications. ASOS has stated its website and app continued operating normally throughout, and it has cybersecurity and business continuity insurance in place with a major global insurer, though it says it is too early to gauge any impact on trading performance.

What Customers Should Do NowSecurity teams and consumers alike should treat this as a reminder that a dramatic-looking notification is not, on its own, proof of a specific type of compromise. ASOS customers are advised to:

Avoid clicking the Telegram link referenced in the rogue notification, and ignore any follow-up messages that try to leverage the incident to request passwords or payment information.

Watch official ASOS channels for verified updates rather than relying on screenshots circulating on social media.

Change their ASOS password if they have reused it anywhere else, and enable unique, strong passwords going forward.

Monitor bank and card statements for unusual activity, even though ASOS says payment data is not believed to be affected.

ASOS says it is working with external specialists and relevant authorities to determine the scope of the incident. Until that investigation concludes, the gap between what attackers claim and what has actually been verified remains the central open question — one that will likely shape how seriously regulators and customers treat the retailer’s next update.