Cyber security is once again firmly on the retail agenda following a string of incidents affecting major brands. TFG London has confirmed that a cybersecurity incident has impacted some IT systems across Phase Eight, Hobbs and Whistles, following the recent ASOS incident and reports of a potential incident involving H&M.
The latest developments have attracted widespread media attention, including coverage from The Independent and BBC News. Against this backdrop, NCC Group experts share their perspective on what these incidents tell us about the evolving cyber threat facing retailers.
Ade Clewlow MBE, senior advisor at global cyber security company NCC Group, said:
“Retailers are prime targets for cyber criminals because they hold vast amounts of valuable customer data. They also have wide attack surfaces due to complex digital ecosystems spanning payment systems, online platforms and third-party suppliers. As a result, cyber attacks can have consequences that extend well beyond the initial breach. “Even when customers’ financial information or login credentials have not been compromised, personal details such as names, email addresses, phone numbers and even search histories can be highly valuable to criminals, as we saw with last week’s Asos attack. This information can be used to create convincing phishing messages that impersonate trusted retailers and exploit customers’ trust in familiar brands. Customers should be particularly cautious of unexpected messages about orders, refunds, account security or compensation, and verify any claims through official channels. “As we approach Black Friday and the busy festive period, retailers become an attractive target to cyber criminals, given the potential for significant disruption and the opportunity to extort ransom payments. In preparation, retailers need to look beyond their own security controls. Third-party suppliers and connected systems can introduce vulnerabilities that criminals may exploit to gain access to a wider business. Organisations need to understand where their data is held, who can access it and whether their suppliers meet appropriate security standards. High profile retail companies need to have a better understanding of how threat actors target their sector, to better protect consumer data. Without knowing how the cyber criminals will conduct an attack, it’s almost impossible to implement the most appropriate defensive measures.”
Ade Clewlow biography
Ade is an Associate Director at NCC Group with more than 35 years of leadership experience spanning military, international security, strategic communications and senior cyber advisory roles.
A former British Army Officer, he served for 25 years and retired as a Lieutenant Colonel, holding key positions across information assurance, defence education and operational command.
After leaving the military in 2012, Ade worked internationally in Somalia and Qatar before moving into senior cybersecurity roles, first with Thales, then joining NCC Group in 2019.
Today, he provides strategic cyber advice to board level and executive audiences across both the public and private sectors, helping organisations improve awareness, strengthen resilience and prepare effectively for crisis scenarios.
Ade regularly co delivers crisis management exercises and is an experienced media commentator. He has appeared on BBC Radio 5 Live and BBC Radio Wales, and has been quoted in The Times, offering clear, practical insight on emerging cyber risks and national level security issues.
