ASOS, TFG, French Supermarkets: Why Retailers Are Under Attack

Picture yourself stepping into your favourite clothing store, only to find the behind-the-scenes systems have come to a halt. Online orders are disrupted, employees lose access to key systems, and customers question when services will be stable again. This isn't hypothetical: it’s the unfortunate reality of what hackers are doing at the moment. 

October 2026 introduced renewed attention to such cyberattacks. Incidents involving ASOS and The Foschini Group (TFG), along with reports about Les Mousquetaires’ French supermarkets and unverified claims about H&M, have put retail cybersecurity under intense scrutiny. 

Retail cyberattacks are becoming a common occurrence. The questions on everyone’s mind are: Why do cybercriminals target retailers, how are these attacks evolving, and are businesses doing enough to protect themselves? Are these attacks isolated events, or do they expose broader weaknesses across retail industries? 

For retail giants running multiple brands, a single cybersecurity incident can trigger a domino effect beyond one storefront. As retailers rely more on networked digital systems, a cyberattack affects customers, employees, and operations.

Cybersecurity expert Chris Steffen, VP of Research at EMA, stated: “Most of the retailers are part of a larger retail group, and those groups generally have shared IT infrastructure (for payments, ERP, but also for back-office identity and data storage). A successful attack on one store can cascade to every store in the chain or retail group.”

This article tells you everything you need to know about retail cyberattacks, why retailers are the target, how cybercriminals gain access to protected systems, the cost of one breach, and how to prevent future attacks on retail companies.

What Makes Retailers Attractive Targets To Cybercriminals?

Retailers unintentionally offer cybercriminals a ‘ of gold’ of vital data, interlinked systems, and pressure to restore services quickly. Customer data, employee accounts, confidential business records, and third-party platforms all offer opportunities for financial gain.

“Retailers are prime targets for cyber criminals because they hold vast amounts of valuable customer data,” said Ade Clewlow MBE, senior advisor at Global Cybersecurity Company at NCC Group. “They also have wide attack surfaces due to complex digital ecosystems spanning payment systems, online platforms and third-party suppliers. As a result, cyber attacks can have consequences that extend well beyond the initial breach.”

According to Steffen, retail businesses are especially attractive because they hold significant amounts of “customer data” and have “thin margins.” They also tend to have less cybersecurity “maturity and zero tolerance for downtime” compared to heavily regulated sectors such as financial, government, and healthcare services.

He also explains, “The bad guys go for the easier targets most likely to pay,” adding that they can collect even small payments from several victims.

The EMA Research VP believes timing is another cause for the recent October incidents. “Peak shopping season is coming, and everyone (including the attackers) knows it. Retailers are too busy prepping for the holiday rush and less interested in implementing ‘new’ cybersecurity initiatives.” 

Seasonal distractions let cybercriminals exploit retailers' already limited capacity to introduce new security measures. During busy shopping periods, the need to keep operations running can make recovery urgent.

Cyber intrusion techniques that have worked in previous incidents may be repeated by organised crime groups (OCGs). They target many businesses rather than depending on one opportunity.

According to the Verizon 2026 Data Breach Investigations Report (DBIR), 997 retail incidents were discovered, including 806 with confirmed data disclosure. The report also noted that system intrusion, basic web application attacks, and social engineering accounted for 95 per cent of retail breaches.

The retailers are targeted not because they share the same vulnerabilities. The findings instead suggest that the retail industry offers cybercriminals an opportunity to monetise entry, steal data, and interrupt operations in various ways.

How Cybercriminals Gain Access to Retail Businesses?

Despite the growing number and complexity of cyber threats, the initial gateway can sometimes be a victim who unintentionally leaks credentials. Attackers don’t always need to exploit complicated technical vulnerabilities to gain unauthorised access.

Kaspersky conducted a recent survey and found that “87 per cent of retailers faced cyber incidents over the past 12 months”.

The recent ASOS data breach explains the risk when cybercriminals steal employee log-in credentials. The retailer confirmed that an unauthorised individual impersonated the victim and gained access to their details. The attacker used the login data to access information through a third-party platform ASOS uses.

ASOS said that the cybercriminal may have acquired basic personal data, including customers' names and contact details, but did not believe it stole payment information or passwords.

The ASOS data breach shows how a compromised account can become a gateway to firewalled systems.

“Social engineering is by far the most common method of attack,” Steffen says. “For the bad guys, the attack is simple: why break in when someone will hand you the keys?”

But social engineering is only part of the risk, as poorly managed third-party access can create blind spots in how businesses monitor activity. This can affect retailers as they rely on service providers and external suppliers that may hold access to essential business systems.

The EMA cybersecurity expert argues that identity security should be a priority, especially when retailers depend on unstructured procedures to grant third-party access.

“Most are still using email and spreadsheets to allow third parties access to critical business systems,” Steffen highlights the limited monitoring of who has access, which systems they can reach, why they need it, and how long it should stay active.

Verizon's 2026 DBIR found that 42 per cent of initial access vectors in the retail breach dataset involved exploitation of vulnerabilities, followed by credential abuse at 14 per cent and phishing at 9 per cent. Third-party involvement was documented in 68 per cent of retail breaches. These statistics show why retailers must address technical vulnerabilities, identities, accounts, and third-party relationships.

Can One Breach Disrupt an Entire Retail Group?

Yes, for retail groups operating multiple brands, a single cyber breach can disrupt operations across the wider business, depending on how their digital systems are connected. While shared systems can improve operational efficiency, they can also create dependencies that allow an attacker to move between brands. 

Where network segmentation and access controls are inadequate, a compromised account or system could provide a route into other parts of the group, turning an isolated incident into a wider operational disruption.

Steffen categorises payment systems, enterprise resource planning (ERP), back-office identity services, and data storage as examples of infrastructure that a retail group may share. If these systems are not separate, one attack affecting a single area of the business could disrupt others. The length of any impact depends on the retailer’s incident response measures, security controls, and system architecture.

The Foschini Group (TFG) cyberattack is a valuable case of why the difference matters. TFG publicised that a cybersecurity incident affected certain IT systems associated with Phase Eight, Hobbs and Whistles. According to the BBC, TFG said its stores were open and operating as usual, but some systems were unavailable. 

The company also shared that its other UK brands, Inside Story and White Stuff, were unaffected, as were its African and Australian branches. This is because the unaffected businesses use separate systems. Being part of a larger retail group does not mean all brands or regions are disrupted. Separated systems can significantly reduce the scope of incidents.

For instance, cyberattacks affecting refrigeration and freezer systems at French supermarket Intermarché revealed that connected technology can create difficulties beyond regular data theft. The incidents disrupted refrigeration equipment and led to food losses, underscoring the physical and operational impacts of poorly connected and secured systems. Coopérative U was also hit, and its Chief Executive called the attack “unprecedented”.

How Can Retailers Protect Themselves From Future Attacks?

Not every cyber risk can be eliminated, but retailers can reduce the risk of a single compromised account or vulnerable system causing wider business disruption.

Cybersecurity expert Steffen advises beginning with “stronger identity controls.” Multi-factor authentication (MFA) can make stolen passwords less useful to attackers, while clearer help-desk identity authorisation methods can reduce the risk of criminals pretending to be employees or trusted contacts.

Third-party access also needs stronger supervision. Retailers should know which suppliers can access vital systems, what permission they hold, and whether that access is still necessary. Access should be restricted to the required systems and tasks, reviewed regularly, and withdrawn when no longer needed.

Steffen also mentions, “investing in network micro-segmentation would (as each retailer operates in isolation from others) also help.” When enterprise systems work separately in smaller isolated security zones down to the level of individual workloads or applications, retailers reduce the attack surface notably. 

That means a problem affecting one brand or business unit will be reduced enough to potentially stop the problem extending across a wider organisation.

Although retailers have strengthened their defensive tooling, including revisiting their incident response plans, the expert warns that retailers “still have immature controls and processes in the identity realm.” 

Preparation for a cyberattack needs to go beyond strengthening technical defences. Retailers are advised to test incident response plans, set clear staff responsibilities, and ensure staff understand how to keep vital services running during an attack. It helps prepare for disruptions to payment services and e-commerce platforms their businesses depend on.

Going forward, Steffen expects “AI-powered social engineering” to become more prevalent. He said, “We have already seen convincing voice clones and phishing at scale.” 

AI-driven advancements come with increased AI-driven attacks, such as OpenAI’s rogue AI hacking into Hugging Face systems. Such new AI technological developments could put pressure on existing defences and make verification procedures, employee awareness and layered security controls increasingly important.

Cybersecurity should be treated as a business continuity priority, not as an IT expense. As the cybersecurity analyst said: “If your point-of-sale, ecommerce, or supply chain goes dark during the peak season, the loss of revenue and consumer perception may not be recoverable. Fund it accordingly”.

Not all retailers are equally exposed; however, Professor Ryan Ko, Director of the University of Queensland’s Cyber Research Centre, told ABC News that “being a target is not the same as being vulnerable.” 

While large enterprises may attract more attention, small retailers with fewer resources can often be easier to compromise and target.

The October 2026 incidents don’t necessarily mean that every retailer faces the same threats or that all cyberattacks will affect a whole enterprise. However, they do highlight a shared challenge: retailers must protect not only customer data but also the systems and relationships that keep their businesses operating.

So, are cybercriminals one step ahead? Not always, but cybercriminals can still achieve their goal by exploiting individuals, third-party access, and interconnected systems faster than retailers can strengthen them. 

In an industry that relies heavily on speed, dependability, and trust, preparing for a potential cyberattack is just as important as preventing one.