Recent cyber incidents have affected fashion retailers in the UK and supermarket operators in Europe, involving customer information, IT services and even refrigeration systems. Investigations are ongoing, but these developments provide a timely reason for businesses in every sector to review how they manage privacy and cyber security risks.
Fashion retailers: ASOS and TFG London
On 6 October 2026, some ASOS customers received an unauthorised app notification. According to the retailer’s official customer update, an attacker obtained an employee’s credentials by impersonating a trusted contact, then used them to access information on third-party platforms.
The information accessed included customer names and contact details. ASOS says no customer account passwords or payment card information were accessed. It restricted access to the affected platforms and launched an investigation with internal and external specialists, which remains ongoing. The involvement of external platforms does not, by itself, establish responsibility on the part of a provider.
TFG London, the UK subsidiary of The Foschini Group, identified a cyber security incident on 11 October 2026 affecting IT systems that support its Hobbs, Whistles and Phase Eight brands. It said it is investigating with the support of external cyber security specialists. Reporting describes the precautionary suspension of online orders while physical stores remained open. The extent of any customer data exposure is yet to be established. Further details are available from Reuters and The Guardian.
Supermarkets: French refrigeration systems and Ahold Delhaize
Overnight on 11–12 October 2026, a cyber attack affected connected refrigeration systems at hundreds of French supermarkets, triggering defrosting and forcing stores to discard affected fresh and frozen products.
According to AFP reporting published by RTL, retailers confirmed at least 300 affected Intermarché/Netto outlets, fewer than 100 Coopérative U stores, 80 Carrefour supermarkets, around 30 Monoprix stores and several E.Leclerc locations.
Danfoss, the Danish supplier of the refrigeration management software, said most affected units were older products that no longer received software or security updates. The Paris prosecutor’s office opened an investigation into the attack, including the damage reported. The precise attack mechanism remains publicly unconfirmed.
In its official announcement on 12 October 2026, Ahold Delhaize, the Netherlands-based supermarket group, confirmed a security issue within its network. The group said its teams were assessing and mitigating the issue and had taken some systems offline as a protective measure. Stores remained open and continued serving customers. The announcement did not specify the cause, identify all affected systems or confirm whether personal information had been accessed.
What businesses should consider
Investigations remain ongoing, and in some cases personal data may not have been affected. It would therefore be premature to draw conclusions about causes or responsibility. Nevertheless, these incidents underline why organisations across all sectors need to consider both cyber security and privacy within their risk management and governance.
Where a company uses IoT (Internet of Things) devices, its assessments should include connected equipment, remote access, maintenance arrangements and potential operational impacts. Where personal data is processed, privacy risks also need to be assessed. Equipment that sits outside conventional IT functions still needs clear ownership and oversight.
Access controls require appropriate authentication, proportionate permissions and regular reviews of employee and supplier access. Organisations should understand who can access information or control systems, for what purpose and how that access is monitored and withdrawn.
Technical and organisational measures should work together. System updates, monitoring and protective controls need to be supported by policies, staff training, escalation procedures and tested incident-response arrangements. Data minimisation and effective retention practices can also help limit the information exposed if an incident occurs.
Working with third parties and platform service providers requires meaningful due diligence, clear contractual responsibilities and ongoing oversight. Organisations should understand what providers can access, how information and systems are protected and how the parties will cooperate during an incident.
Risk assessments should bring these elements together and be revisited as technology, services and business activities change. ENISA’s IoT security recommendations and IoT supply-chain guidance provide useful reference points. Where personal data is involved, the EDPB’s Data Protection by Design and by Default guidance offers a complementary privacy framework.
There is no one-size-fits-all solution. Appropriate safeguards depend on the organisation’s environment, activities and potential impacts. Specialist privacy and cyber security professionals should work with business and operational teams to identify proportionate measures that minimise exposure.
Our Privacy Division can support this approach through risk assessments, privacy programme reviews, supplier governance and breach-readiness work, in collaboration with cyber security specialists.
This article is based on public information available on 13 October 2026. Findings and reported figures may change as investigations progress.