From ASOS to Hobbs, Whistles and Phase Eight, fashion retailers are finding themselves in cyber criminals’ sights. But the real lesson extends far beyond the high street.
Fashion has always had its copycats. Protecting a designer’s latest creation from counterfeiters is one thing; protecting the business behind the brand from cyber criminals is quite another.
And right now, hacking appears to be very much en vogue.
On 6 October, ASOS customers received an alarming notification through the retailer’s own app. Headlined “ASOS HACKED”, it claimed the business’s data had been compromised and threatened to release information unless the attackers were contacted.
Just days later, the picture became more concerning. Hobbs, Whistles and Phase Eight, owned by retail group TFG London, were affected by a separate cybersecurity incident identified on Sunday 11 October. The company has activated its incident response and business continuity plans and brought in external cybersecurity specialists. While stores remain open, some IT systems are unavailable and customers have been warned that orders placed since Sunday may be delayed. TFG says there is currently no reason to believe payment information is at risk, but its investigation into whether other sensitive information has been affected is continuing.
Then came news that Swedish fashion giant H&M was investigating claims that it had been targeted by cyber criminals. At the time of reporting, the company had not confirmed a data breach.
These hacking incidents are not necessarily connected, and the details differ. But their proximity is a timely reminder that cyber security is becoming an increasingly important issue for fashion and retail businesses.
The warning signs have been there for some time. In August 2025, luxury group Kering confirmed that customer information associated with Gucci, Balenciaga and Alexander McQueen had been accessed by attackers. Earlier reporting had also documented hacking incidents involving major fashion names including Adidas and LVMH.
And the problem extends beyond fashion. According to Verizon’s 2026 Data Breach Investigations Report for Retail, breaches in the retail sector nearly doubled, with attacks increasingly focused on internal corporate data rather than simply payment-card information. Verizon
The message is clear: no brand is too established, too recognisable or too successful to become a hacking target.
When trust becomes the way in
ASOS’s account of what happened is particularly instructive because it highlights a weakness that technology alone cannot necessarily solve.
In its customer update on 8 October, the retailer explained that an unauthorised party had gained access to an employee account by impersonating a trusted contact to obtain login credentials. Those credentials were then used to access information on certain third-party platforms used by ASOS.
The company confirmed that some customers’ personal information, including names and contact details, had been accessed, alongside certain non-personal account-related information. It said payment-card information and account passwords had not been accessed. The investigation was continuing. ASOS customer update
The unauthorised notification was the visible part of a wider security problem: someone had obtained credentials and used them to reach platforms beyond the employee account itself.
This is the danger of social engineering. An attacker may not need to defeat every technical safeguard if they can persuade someone to trust the wrong person, disclose credentials or approve an access request. The result can be a compromise that crosses the boundaries between employees, business systems and external service providers.
It is also a reminder that third-party access deserves the same scrutiny as access within an organisation. Modern businesses depend on a growing ecosystem of cloud services, software platforms, communications tools and external partners. Each connection brings benefits, but each also needs to be understood and properly secured.
Fashion is the headline. Every business is the target.
Retailers make attractive targets for several reasons. They hold substantial volumes of customer information, depend on digital channels to generate revenue and maintain complex systems spanning payments, logistics, marketing, customer service and stock management.
Disruption can affect sales and customer relationships, while stolen personal information can be used for further fraud, convincing phishing messages or targeted scams.
But the underlying risks are not exclusive to retail. Financial services, professional firms, manufacturers, charities and smaller businesses all depend on digital systems and external platforms. They all have employees, credentials, suppliers and data that criminals may seek to exploit.
Nor does an organisation have to be a household name to be worth attacking. A smaller business may have fewer resources to devote to security, yet still hold valuable information or provide a route into another organisation’s systems.
The lesson from ASOS is not that every company faces an identical threat. It is that businesses need to understand where their own vulnerabilities lie, including the less obvious routes through which an attacker might gain access.
Prevention is better than a very expensive cure
The first step is not necessarily to buy another security product. It is to understand the risks and make sure the basics are covered.
Know who has access. Review employee and third-party accounts, particularly those with privileged access to sensitive information or business-critical systems. Remove permissions that are no longer required and ensure access is proportionate to the job being done.
Strengthen authentication. Use multi-factor authentication, particularly for accounts accessing sensitive information and administrative systems. Where possible, use phishing-resistant methods. Credentials should never be treated as proof of identity simply because they appear to be correct.
Look beyond your own network. Understand which external platforms hold your data, how they are accessed and what safeguards are in place. Establish who is responsible for security across the services on which your business depends.
Prepare for the possibility that something gets through. Keep reliable, protected backups and make sure recovery arrangements are tested. Know how the business will respond to an incident, who needs to be contacted and how critical operations will continue if systems become unavailable.
Keep security under review. Threats, systems and business dependencies change. Security arrangements that were adequate a few years ago may no longer reflect the way an organisation operates today.
None of these measures offers absolute protection. Together, however, they can reduce exposure, improve the chances of detecting suspicious activity and help limit the damage if an incident occurs.
Where does vXtream fit in?
For some organisations, reading about another high-profile cyber incident will prompt an uncomfortable question: Are we adequately protected?
Others may already know that parts of their security arrangements need attention but feel uncertain about where to begin, what to prioritise or how much additional protection they actually need.
The answer is not necessarily to replace everything or buy another product. It starts with understanding the business, the infrastructure it relies on and the risks it needs to manage.
At vXtream, we provide managed infrastructure and cyber security services that can help organisations strengthen their defences and improve resilience.
Our services include Sophos Intercept X endpoint protection, AlienVault USM security monitoring and threat intelligence, and DDoS protection. We also provide managed cloud infrastructure and Veeam-based backup solutions, including S3 Object Lock, to support data protection and recovery.
These technologies address different parts of the security and resilience picture. Their effectiveness depends on how they are deployed, managed and integrated with an organisation’s wider security arrangements. No provider or product can promise to prevent every attack.
But technology is only part of the answer. Businesses also need to understand their existing arrangements, identify gaps and decide what action makes sense for their circumstances.
That is where a conversation can make a difference.
You don’t have to work it out alone
Cyber security can feel daunting, particularly for businesses without a large in-house team. The headlines are alarming; the technology can be complicated and the range of products and services available can make it difficult to know which advice to follow.
Sometimes, the best first step is simply to talk to someone who understands the technology and the risks.
At vXtream, we believe in understanding your business, listening to your concerns and working through the options together. That might mean reviewing your infrastructure, discussing your security arrangements, looking at backup and recovery, or identifying areas where you need more specialist advice.
It doesn’t have to begin with a major project or a shopping list of new products. It can begin with a straightforward conversation about what worries you and what you already have in place.
Fashion trends come and go. Cybercrime is proving rather more persistent. The organisations best placed to deal with it will be those that take security seriously before an incident forces their hand.
You don’t need to wait for an incident to find out where you may be exposed. Let’s work through your concerns together and identify the practical steps that can help protect your business.
Worried about your security? Let’s talk.
Image by SHVETS production
Comments are closed.