Three breaches, three different front doors
In the span of roughly a week in mid-October, three major fashion retailers operating in the UK disclosed or confirmed cybersecurity incidents. The Foschini Group's UK subsidiary, TFG London, detected an attack on a Sunday that disrupted IT systems supporting its Hobbs, Whistles, and Phase Eight brands, a footprint of roughly 550 stores. Websites went down and backend order processing and stock visibility were affected, though physical stores kept trading and TFG's other UK brands, White Stuff and Inside Story, were unaffected, as were its Africa and Australia operations on separate systems.
Asos confirmed its own breach days earlier, after an attacker impersonated a trusted contact to obtain an employee's login credentials, then used that access to reach customer names and contact details stored on third-party platforms. Asos said payment card data and passwords were not compromised. And H&M began investigating a claim, first reported by The Times of London, that a criminal group had breached its systems entirely separately from either of the other two incidents. Three retailers, three incidents, inside one news cycle, and critically, three different access paths.
The H&M claim routes through a warehouse robotics vendor
The most structurally interesting of the three incidents is the H&M claim, because of who is claiming it and how they say they got in. A group calling itself ShinyEquationCartel, which says it includes former members of ShinyHunters alongside people associated with Lapsus, HellCat, and LockBit, claimed responsibility on Telegram and a darknet site. The group released a sample of data tied to GreyOrange, the warehouse robotics software H&M uses in its North American distribution centers, including order information and links to product images. H&M told reporters it had found no indication that its data environment had been compromised, a denial that, notably, addresses H&M's own systems rather than the third-party robotics platform the attackers specifically named.
That distinction matters more than it might first appear. A retailer can accurately say its own environment is intact while a vendor holding operationally sensitive data, in this case a robotics platform with visibility into warehouse order flow, has been compromised. None of the claims from ShinyEquationCartel have been independently verified, but the group's composition, drawing from several previously distinct extortion crews, points to a consolidating criminal ecosystem rather than an isolated actor, one that has apparently learned retailers' warehouse automation vendors are softer targets than the retailers' own front doors.
ShinyHunters' reach makes every claim harder to dismiss
ShinyHunters, the group ShinyEquationCartel claims lineage from, has been linked to attacks on more than 140 organizations and at least $70 million in ransom payments, according to context compiled around the TFG and H&M incidents. Its leak sites reportedly list 99 files totaling roughly 6.5 terabytes of stolen data. Several suspected members have already been arrested or detained, including a 16-year-old in Jordan, a 24-year-old Dutch national, and a Canadian ransomware negotiator, arrests that would normally suggest a group in decline. Instead, splinter factions claiming the brand's lineage, like ShinyEquationCartel, keep surfacing against new, high-profile retail targets.
That persistence despite arrests is the pattern enterprise security teams need to internalize. Taking down individual members of a prolific extortion brand does not retire the brand's playbook or its access techniques; it just redistributes them to whoever claims the lineage next. A retailer evaluating its own exposure to a ShinyHunters-linked threat should not take comfort from headlines about arrests, because the attack techniques, impersonating trusted contacts, targeting warehouse and logistics vendors, abusing third-party platform integrations, clearly outlive any specific roster of operators.
Why physical stores staying open is the wrong headline to focus on
Every public statement from TFG, Asos, and H&M has emphasized that stores remained open and operational throughout. That's true, and it's the detail every retailer's PR team reaches for first because it reassures shareholders and shoppers in the same sentence. But store-level continuity was never really the risk in any of these three incidents. The risk sat in backend order processing, stock visibility, warehouse robotics data, and customer contact records, the systems that determine whether a retailer can fulfill the orders its stores and websites generate, not whether a customer can walk in and buy a jacket today.
Marks & Spencer's 2025 cyberattack is the cautionary precedent worth keeping in view here. Its online clothing orders were suspended for seven weeks, with its 2025/26 results later showing £131.3 million in incident-related costs and a 7.7 percent fall in fashion, home, and beauty sales. Stores stayed open throughout that incident too. The damage showed up months later in the fulfillment and e-commerce numbers, not in day-one store traffic, and that is exactly the lag retail CIOs should be modeling for TFG, Asos, and H&M rather than taking early reassurances at face value.
What belongs on the retail security roadmap
The structural lesson from this cluster is that the attack surface retailers need to defend has moved outward, to warehouse robotics vendors, logistics platforms, and the trusted-contact relationships employees maintain with suppliers and partners. Perimeter defenses around a retailer's own network are necessary but no longer sufficient when attackers have learned that a robotics vendor with access to order flow data is an easier target with a similar payoff. TFG, Asos, and H&M each had different root causes, which is itself the point: there is no single control that would have stopped all three, which means the defensive answer has to be a portfolio of controls across internal systems, employee verification, and vendor access, not a single investment in any one of them.
Concretely, that means extending vendor risk reviews to cover operational technology and warehouse automation platforms with the same rigor applied to payment processors, verifying that employee identity-verification processes for contact changes can't be defeated by impersonation alone, and building incident response plans that assume backend fulfillment disruption, not storefront outage, as the primary business continuity risk. It also means asking every logistics and robotics vendor directly what they would tell you, and how fast, if their own platform were the one breached instead of yours. The retailers in this cluster will spend the next two quarters finding out which of those gaps they had. The ones reading about it now have the chance to find out before an invoice, or a leak site, tells them.
