5 lessons from this month’s retail cyber attacks

Cyber Security Awareness Month: Lessons From the Headlines

As it’s Cyber Security Awareness Month, it’s a good moment to look at the attacks making the headlines — and what every business can learn from them. October has already seen two well-known names in UK fashion retail hit, following the high-profile attacks on M&S and Co-op in 2025.

These incidents involve large brands, but the techniques behind them work just as well against small and medium-sized businesses. The good news is that the defences are well understood, and most of them are affordable.

What Happened?

ASOS

On 6 October, ASOS confirmed that an unauthorised message had been sent to customers through its mobile app. The company said an attacker gained access to an employee account by impersonating a trusted contact to obtain login credentials, then used them to access information held on third-party platforms ASOS uses. Customers’ names and contact details were affected; ASOS says passwords and card details were not.

TFG London (Phase Eight, Hobbs and Whistles)

On 11 October, TFG London — the UK business behind Phase Eight, Hobbs and Whistles — detected a cyber incident affecting its IT systems. Stores stayed open, but several systems were unavailable while the company activated its incident response and business continuity plans and brought in outside specialists. At the time of writing, it is still investigating whether any personal data was taken.

Breaking: a Critical Flaw in PHP

As if to prove the point, on 21 October the PHP project released an emergency security update for two critical flaws, nicknamed “PHP2Shell”. PHP is the software behind WordPress and millions of other websites, and the flaws could let an attacker take over a web server running it without needing to log in.

Attacks were spotted before the fix was even released, and security researchers expect widespread attempts now that the details are public. The UK’s National Cyber Security Centre (NCSC) has told organisations to update PHP straight away and, where that isn’t possible quickly, to consider taking affected systems offline until they’re fixed.

What should you do?

• Check your website. If it runs on WordPress or another PHP platform, ask your web host or developer to confirm PHP has been updated. In WordPress you can see your PHP version under Tools > Site Health > Info > Server.
• Retire old versions. PHP versions older than 8.2 no longer get security updates, so sites still running them need upgrading.
• Check your other systems. PHP is also built into some business applications and devices, so look out for security updates from those suppliers too.
• Not sure? Ask us. We’ll happily check whether your website or systems are affected.

5 Ways to Protect Your Data — and Your Clients’ Data

1. Use phishing-resistant sign-ins

The ASOS attack started with stolen credentials. Multi-factor authentication (MFA) stops most of these attacks, but not all MFA is equal: text-message codes can be intercepted or talked out of people. Passkeys and the Microsoft Authenticator app are far stronger. Microsoft is already making passkeys the default for Microsoft 365 sign-ins and will stop sending its own SMS and voice verification codes from 1 February 2027.

2. Watch for follow-up scams

After a breach, criminals use stolen names and contact details to send convincing follow-up emails and texts. Be suspicious of any unexpected message asking you to reset a password, confirm details or act urgently — even if it appears to come from a brand you trust. Go to the company’s website or app directly instead of clicking a link.

3. Know your suppliers

Both attacks touched systems beyond the retailer’s own walls. Make a list of the suppliers and platforms that hold your data or your clients’ data, and ask them how they protect it: do they use MFA, do they hold Cyber Essentials or ISO 27001, and how would they tell you about a breach?

4. Test your backups

A backup only counts if you’ve proved you can restore from it. Check that your Microsoft 365 data (email, OneDrive, SharePoint and Teams) is backed up separately, that at least one copy can’t be changed or deleted by an attacker, and that you’ve tested a restore recently.

5. Have an incident plan

TFG London was able to keep its stores trading because it had incident response and business continuity plans ready to go. Your plan doesn’t need to be long: who to call, who makes decisions, how you’ll keep working, and how you’ll communicate with staff and clients in the first hour.

Reflective IT Tip

Not sure whether your team is still using text-message codes? Ask your Technical Account Manager. We can check your Microsoft 365 sign-in methods and help you move everyone to passkeys or the Authenticator app before Microsoft’s February 2027 deadline.

How Reflective IT Can Help

We aim to bring every client’s Microsoft Secure Score up to 80% or above. Our recommended security stack — Microsoft 365 Business Premium, Microsoft Defender and Cisco Umbrella — covers phishing-resistant sign-ins, email and device protection, and web filtering, and we can help with backup, Cyber Essentials and incident planning too.

Frequently asked questions

Were small businesses affected by these attacks?

These incidents affected large retailers, but the same techniques — impersonation, stolen credentials and attacks on suppliers — are used against businesses of every size.

Is text-message MFA still better than nothing?

Yes. Any MFA is much better than a password alone, but passkeys and the Authenticator app give far stronger protection against phishing.

What should I do if I receive a suspicious email?

Don’t click any links or open attachments. Forward it to support@reflectiveit.com or call us, and we’ll check it for you.

Need Help or Have Questions?

Our team is always happy to help. Contact us, speak to your Technical Account Manager, or get in touch directly:

📞 0207 317 4535 | 📧 support@reflectiveit.com