UK retailers have experienced a series of cyberattacks over the past week, prompting experts to describe the incidents as a “brutal alarm call.” The owners of fashion brands like Hobbs and Whistles, as well as the Swedish fashion giant H&M and fast-fashion retailer Asos, have all announced investigations into potential hacks.
The UK retail sector has faced numerous cyber threats over the last two years, with prominent names such as Marks & Spencer (M&S), Co-op, and Harrods being targeted by hackers. Recently, Asos disclosed that it is looking into “unauthorised activity” related to a third-party platform after customers received a notification indicating that the online retailer had been hacked.
Experts Warn of Thin Corporate Defences
Susannah Streeter, chief investment strategist at investment service Wealth Club, said: “Corporate defences are looking dangerously thin amid an onslaught of cyber attacks against businesses.
“This spate of infiltrations into retailers’ systems should serve as a brutal alarm call for organisations grappling with increasingly sophisticated digital threats.”
Here is a full list of the largest cyber attacks reported over the last two years.
TFG London
The owner of women's wear brands Hobbs and Whistles issued an apology to customers on Tuesday following a cyber attack. The South African retail group The Foschini Group (TFG) reported that it became aware of a cybersecurity incident on Sunday, which affected its UK subsidiary, TFG London, and impacted certain IT systems, specifically relating to the Phase Eight, Hobbs, and Whistles brands.
TFG stated that there is "no reason to believe that payment information is at risk" and confirmed that it is collaborating with cybersecurity specialists to investigate the incident. Additionally, TFG London’s other high street brands, Inside Story and White Stuff, were not affected, nor were TFG’s operations in Africa and Australia.
H&M and Asos
Swedish fashion giant H&M announced on Monday that it is investigating claims that the cybercriminal group Shinyhunters targeted it last week. This hacking group had previously claimed responsibility for a significant cyber attack on JLR last summer, along with other groups known as Scattered Spider and Lapsuss.
An H&M spokesperson stated on Tuesday, “We are aware of information circulating online about a possible cybersecurity incident and are currently looking into these claims. At this time, we have not found any indications that our data environment has been compromised.”
Last week, the fast fashion retailer Asos announced that an "unauthorised party" had accessed some personal data, including names and contact details of customers. On Tuesday, Asos customers received a phone alert indicating that the retailer had been hacked, with claims that the data storage firm Snowflake had been compromised.
Asos confirmed that the cyber attacker had gained access to certain personal information. However, Snowflake later stated that the breach was not due to any vulnerability or flaw in its platform.
Welsh Police Force and UK Airports
Dyfed-Powys Police reported a cyber attack on September 14, which may have compromised staff information. The police force indicated that the incident disrupted some non-emergency systems, but stated that no personal data belonging to members of the public was believed to have been accessed. An investigation is underway, and the force will provide further updates when they are able to do so.
Three major UK airports experienced a “cyber security incident” in which the data of approximately 8.7 million customers was accessed, according to Manchester Airport Group (MAG) in August. The company, which operates Manchester Airport, London Stansted Airport, and East Midlands Airport, stated that “at no point has passenger safety or aviation security been compromised” during the incident.
The majority of the accessed data was limited to customer email addresses, phone numbers, vehicle registration numbers, and postcodes, primarily related to Wi-Fi sign-ups within the airport terminals. MAG reported that hackers demanded a ransom, which was not paid, but the company did not disclose the amount.
Craneware and JLR
Healthcare technology firm Craneware announced in July that it had been targeted by a cyber attack in which hackers stole some customer and employee data. The Edinburgh-based company provides software to the U.S. healthcare industry, serving thousands of hospitals, clinics, and pharmacies. Craneware reported that a significant number of file names were viewed and exfiltrated during the incident. Fortunately, the situation was contained, and it did not disrupt customer services or the company's operations, according to the firm and external specialists who were brought in to assess the matter.
JLR experienced a significant loss last year after incurring nearly £200 million in additional costs due to a major cyber attack, which forced the company to shut down its factories for over a month. The UK's largest car manufacturer halted production at its UK facilities for five weeks, starting on September 1, 2025, after being targeted by hackers the day before. As a result, the company's revenues fell by more than £1 billion, approximately 24%, reaching £4.9 billion for the quarter ending in September last year. The ShinyHunters group claimed responsibility for the attack on a Telegram channel, along with other English-speaking hacker groups, Scattered Spider and LapsusS.
M&S, Co-op and Harrods
M&S faced significant disruptions last year due to a cyber incident. The high street retailer had to halt all online sales for approximately six weeks, which resulted in empty shelves caused by disruptions to its logistics systems after being targeted by hackers around the Easter weekend in 2025. In May of this year, the London-listed company reported a 23.8% decline in pre-tax profits, which fell to £671.4 million for the year ending in March. The cyber attack had a particularly adverse effect on the company's fashion, home, and beauty operations. Online sales were suspended, stock flow was disrupted, and product availability was limited as a result of the incident. The group known as Scattered Spider was later identified as responsible for the attack.
In May of last year, Co-op apologized to its customers after their IT systems were attacked by “highly sophisticated” hackers. As a result, the Manchester-based retailer had difficulty processing card payments in some stores, leading to empty shelves for shoppers due to the ongoing consequences of the attack. Co-op reported underlying operating losses of £32 million for the six months ending in July of last year, during which they experienced this damaging hack.
Harrods experienced two cyber attacks last year, although the company later stated that the financial impact was "limited." As a precaution following an attempt to gain unauthorised access to its systems, the luxury department store restricted internet access across its sites in May.
