Retailers across the UK have faced a spate of cyber attacks in the past week, prompting experts to warn the incidents should act as a “brutal alarm call”.
The owner of fashion brands Hobbs and Whistles, Swedish fashion giant H&M and fast fashion business Asos all said they were investigating potential hacks in the past week.
The UK retail sector has been targeted many times in the past two years, with Marks & Spencer (M&S), Co-op and Harrods among the biggest names being hit by hackers.
Susannah Streeter, chief investment strategist at investment service Wealth Club, said: “Corporate defences are looking dangerously thin amid an onslaught of cyber attacks against businesses.
“This spate of infiltrations into retailers’ systems should serve as a brutal alarm call for organisations grappling with increasingly sophisticated digital threats.”
Here is a list of the largest cyber attacks reported over the last two years.
TFG London
The owner behind womenswear brands Hobbs and Whistles apologised to customers on Tuesday after being hit by a cyber attack.
South African retail group The Foschini Group (TFG) said it became aware of a “cybersecurity incident” on Sunday, affecting its UK subsidiary TFG London with “certain of its IT systems” impacted – specifically its Phase Eight, Hobbs and Whistles brands.
The Foschini Group owns brands including Hobbs (Ian West/PA)
PA Archive
TFG said there was “no reason to believe that payment information is at risk”, adding it was working with cybersecurity specialists to investigate the incident.
TFG London’s other high street brands Inside Story and White Stuff were not affected, neither were TFG’s operations in Africa and Australia.
H&M
Swedish fashion giant H&M said on Monday it was investigating claims it was targeted by cybercriminal group Shinyhunters last week.
The hacking gang had previously claimed it was behind a major cyber attack on JLR last summer, along with other hacking groups known as Scattered Spider and Lapsus.
An H&M spokesperson said on Tuesday: “We are aware of information circulating online regarding a potential cyber security incident and are currently investigating the claims.
“At this time, we have not found any indications that our data environment has been compromised.”
Asos
Fast fashion retailer Asos last week said an “unauthorised party” had gained access to some personal data, including names and contact details.
Last Tuesday, Asos customers received a phone alert saying that the retailer had been hacked, which claimed the data storage firm Snowflake had been compromised.
Asos is using AI to suggest outfits for shoppers (Alamy/PA)
Asos said the cyber attacker gained access to some personal data, including names and contact details.
Snowflake later said the breach was not caused by a vulnerability or flaw with its platform.
Welsh police force
Dyfed-Powys Police identified a cyber attack on September 14, which it said may have resulted in staff information being compromised.
The force said the incident had caused disruption to some non-emergency systems, adding no personal data relating to members of the public was thought to have been accessed.
An investigation was launched and the force said it would provide further updates when “in a position to do so”.
UK airports
Three major UK airports were hit by a “cyber security incident” in which the data of about 8.7 million customers was accessed, Manchester Airport Group (Mag) said in August.
The company, which operates Manchester Airport, London Stansted and East Midlands Airport, said “at no point has passenger safety or aviation security been compromised” during the incident.
The majority of the data accessed was restricted to customer email addresses, phone numbers, vehicle registration numbers and postcodes, and related to wifi sign-ups within the airports’ terminals, it was understood.
Mag said the hackers demanded a ransom fee which was not paid, and did not disclose the amount.
Craneware
Healthcare technology firm Craneware said in July it had been hit by a cyber attack with hackers stealing some customer and employee data.
The Edinburgh-based company provides software to the US healthcare industry, including thousands of hospitals, clinics and pharmacies.
Craneware said a significant volume of file names were viewed and exfiltrated through the hack.
The incident was later contained and did not disrupted customer services or the company’s operations, according to the business and external specialists brought on board.
Jaguar Land Rover temporarily shut production following its cyber attack (JLR/PA)
PA Media
JLR
JLR plunged to a heavy loss last year after booking almost £200 million in extra costs linked to a major cyber attack which saw the firm shut its factories for more than a month.
The UK’s largest car manufacturer stopped production across its UK factories for five weeks from September 1 2025 after being targeted by hackers a day earlier.
The group saw revenues plummet by more than £1 billion, around 24%, to £4.9 billion for the quarter to September last year.
The ShinyHunters group claimed on a Telegram channel they were behind the incident, along with other English language-speaking hackers Scattered Spider and LapsusS.
M&S
M&S spent months dealing with disruption caused by a cyber incident last year.
The high street chain was forced to stop all online sales for about six weeks and had empty shelves because of disruption to its logistics systems, after it was targeted by hackers around the Easter weekend in 2025.
The London-listed firm said in May this year that its pre-tax profits had fallen by 23.8% to £671.4 million for the year to the end of March.
The hack particularly impacted the group’s fashion, home and beauty operations, with online sales suspended, stock flow disrupted and availability restricted by the cyber attack.
Scattered Spider were later blamed for the incident.
Co-op
Co-op apologised to its customers in May last year after “highly sophisticated” hackers attacked the retailer’s IT systems.
The Manchester-based co-operative was unable to take card payments in some of its stores and shoppers faced empty shelves because of the continued fallout.
Co-op reported underlying operating losses of £32 million for the six months to July last year, when it was hit by the damaging hack.
Harrods
Harrods was hit by two cyber attacks last year, although the group later indicated there had been “limited” financial impact.
The luxury department store restricted internet access across its sites in May last year as a precautionary measure following an attempt to gain unauthorised access to its systems.