In an escalating wave of cyber security incidents shaking the European retail sector, major fashion brands—including ASOS, TFG London (the parent company of Hobbs, Whistles, and Phase Eight), and H&M—have all recently fallen victim to, or found themselves investigating, targeted cyber attacks. These incidents have laid bare a critical reality of modern digital commerce: while corporate email infrastructure has grown increasingly secure through strict email authentication protocols, the human-centric endpoints, third-party messaging platforms, and customer relationship management (CRM) systems remain highly vulnerable to sophisticated social engineering.
The sequence of events underscores an urgent imperative for retailers. Threat actors are no longer relying solely on technical exploits to breach corporate networks. Instead, they are manipulating employees through voice phishing (vishing) and compromising third-party communication tools to hijack push notifications, text messages, and app alerts. For millions of shoppers, the trusted channels they use to interact with their favorite brands are being weaponized against them.
Chronology of the Breaches
The recent cluster of retail security alerts unfolded rapidly over the course of October, demonstrating a coordinated or concurrent pressure on the sector’s digital infrastructure.
October 6, 2025: The ASOS In-App Notification Breach
The crisis broke into public view on October 6, when customers of online fashion giant ASOS received an unexpected, malicious push notification directly through the official ASOS mobile application. The alert falsely claimed that the company had suffered a security breach and directed users to an external Telegram link.
ASOS rapidly identified the intrusion and moved to restrict access to its third-party customer notification platforms—the external software tools utilized by marketing and CRM teams to communicate with shoppers. Subsequent internal investigations revealed that the attacker had not exploited a software flaw in the app itself, but had successfully gained access to an internal employee account by impersonating a trusted contact in a classic social engineering scheme. The unauthorized access allowed the threat actor to exfiltrate customer names and contact details, as well as manipulate the company’s proprietary broadcast channels.
October 11, 2025: TFG London Identifies Breach Affecting Hobbs, Whistles, and Phase Eight
Days later, TFG London—the UK division of South Africa’s Foschini Group and the corporate owner of prominent high-street brands Hobbs, Whistles, and Phase Eight—formally announced it was managing a cyber attack.
According to a regulatory notice filed with the Johannesburg Stock Exchange on Sunday, October 11, TFG London’s technical teams identified the incident and immediately launched an exhaustive forensic investigation to determine the scope of any compromised personal data. While the investigation remains ongoing, preliminary assessments provided a measure of relief to consumers, with the company confirming there is currently no reason to believe that sensitive financial records or payment card information have been exposed. The identity of the threat actor has not been publicly disclosed.
October 13, 2025: H&M Investigates Claims Linked to ShinyHunters
On Monday, October 13, Swedish retail titan H&M confirmed it was investigating claims of a potential data security incident involving a limited scope of its corporate data. The claims were publicly linked to the notorious cybercrime syndicate known as ShinyHunters.
Despite the threat actor’s assertions, H&M stated that its preliminary security audits showed no indication that its core data environment had been compromised. Concurrently, investigative reports from security publications indicated that the data allegedly targeted in the claims encompassed operational assets, including inventory, logistics, sales, and in-store infrastructure.
Supporting Data and Technical Diagnostics
To understand the current cybersecurity posture of these major retailers, security analysts ran diagnostic tests on five primary domains: hm.com, asos.com, hobbs.co.uk, whistles.com, and phase-eight.com using advanced email validation toolkits.
Email Authentication: The Baseline Standards
The technical diagnostics revealed a strong adherence to foundational email security standards across the board:
- SPF Records: All five tested domains successfully publish valid Sender Policy Framework (SPF) records, defining which mail servers are authorized to send email on behalf of each domain.
- DMARC Enforcement: Every single domain enforces Domain-based Message Authentication, Reporting, and Conformance (DMARC) at the strictest policy level of
p=reject.
This means that any malicious actor attempting to spoof these exact corporate domains via email will see their messages immediately rejected by any mailbox provider that honors DMARC. In terms of traditional email authentication, these brands have effectively implemented industry best practices.
Brand Indicators for Message Identification (BIMI)
Adoption of advanced trust indicators varied among the retailers:
- H&M and ASOS: Both brands publish BIMI records. Furthermore, ASOS maintains a verified Mark Certificate (VMC), allowing supporting email client inboxes to display the official corporate logo next to legitimate communications, offering a visual stamp of authenticity to consumers.
- TFG London Brands: Hobbs, Whistles, and Phase Eight do not currently publish BIMI. However, their near-identical domain configurations strongly suggest they are managed under a centralized digital infrastructure.
Official Responses and Threat Intelligence Insights
While technical tools like DMARC successfully prevent domain spoofing via email, security intelligence agencies note that these protocols offer zero protection against the methods actually used in these recent incidents.
The Rise of ShinyHunters and Vishing Tactics
Threat intelligence teams, including Google’s specialized threat analysis units, have extensively documented the tactics employed by threat actors operating under the ShinyHunters umbrella. Rather than hacking through firewalls, these groups rely on human manipulation.
A primary vector involves sophisticated voice phishing (vishing) campaigns. Attackers place telephone calls to corporate employees while posing as internal IT support or trusted corporate partners. Their objective is social engineering: tricking staff members into surrendering multi-factor authentication (MFA) codes or granting remote access to critical cloud-based platforms, including Salesforce and various CRM systems where customer records are centralized.
Government and Regulatory Warnings
Following the ASOS breach, the UK’s National Cyber Security Centre (NCSC) issued formal guidance advising ASOS customers to treat themselves as potentially affected. The NCSC warned that the fallout from such breaches often materializes long after the initial incident, with attackers utilizing stolen contact lists to launch secondary phishing campaigns via SMS, email, and malicious push notifications.
Broader Implications for the Retail Sector
The recent string of attacks highlights a profound strategic shift in the cyber threat landscape. Retailers have spent millions fortifying their perimeter defenses, securing cloud perimeters, and implementing strict email authentication protocols. Yet, these measures leave a dangerous blind spot: the communication tools and CRM ecosystems managed by marketing, customer service, and digital engagement teams.
The Illusion of Authentication
As demonstrated vividly in the ASOS breach, technical authentication protocols confirm who sent a digital message, but they cannot verify whether the right person was holding the controls. When an attacker gains valid credentials through social engineering, they inherit the legitimate authority of the compromised employee. They can bypass security gateways because, from a technical perspective, they are authorized users operating within the system.
Furthermore, once a threat actor acquires a database of names, email addresses, and phone numbers, DMARC and other email controls become entirely obsolete. Armed with this stolen data, criminals can register lookalike domains, configure free webmail accounts with familiar display names, and bombard consumers with highly targeted smishing (SMS phishing) and vishing attacks.
Actionable Recommendations: What CRM Teams Must Check Next
In light of these developments, security leaders and customer relationship management (CRM) teams must look beyond traditional IT controls and audit their own operational environments. Industry experts recommend a five-point checklist to secure customer communication channels:
1. Catalog All Communication Endpoints
CRM teams must establish a comprehensive, living inventory of every platform capable of reaching customers. This includes Email Service Providers (ESPs), SMS gateways, mobile push notification tools, in-app messaging systems, CRM databases, and loyalty program software. Administrators must audit who holds active login credentials for each system and immediately revoke access for former employees, agencies, or contractors who no longer require it.
2. Implement Phishing-Resistant MFA and SSO
Traditional password protection combined with SMS-based verification codes is no longer sufficient against determined attackers utilizing social engineering. Organizations must enforce Single Sign-On (SSO) integrated with phishing-resistant Multi-Factor Authentication (such as hardware security keys or FIDO2-compliant authenticators) across all marketing and customer service platforms.
3. Establish Out-of-Band Verification Protocols
Because ASOS was breached via an attacker posing as a trusted contact, internal teams must establish strict verification protocols for any request involving administrative access or data modifications. Crucially, employee verification must never rely on the same communication channel through which the request originated. A phone call or instant message request must be verified via an independent, pre-established internal channel.
4. Educate Customers and Leverage BIMI
Retailers must actively educate their consumer base regarding what genuine communications look like—and explicitly state what the company will never ask for over text, app notification, or email. Implementing advanced visual trust indicators like BIMI and VMCs helps consumers easily distinguish between official brand communications and fraudulent lookalike messages.
5. Prepare Incident Communication Playbooks
When customer data is compromised, every second counts. Retailers must have pre-drafted customer notification templates ready for deployment before an incident occurs. The ability of a company to rapidly and accurately correct malicious communications sent through its own channels—as ASOS was forced to do—depends entirely on the preparedness and agility of its incident response playbook.
As retail brands continue to digitize and expand their direct-to-consumer engagement channels, securing the human element and the CRM infrastructure has transitioned from a backend administrative task to a critical board-level imperative.
