A growing number of cyber attacks targeting major British retailers has renewed concerns about the security of corporate computer systems, with experts warning that businesses may not be adequately prepared for increasingly sophisticated digital threats.
Marks & Spencer, Co-op and Jaguar Land Rover suffered significant disruption during attacks in 2025, with consequences ranging from empty supermarket shelves to the suspension of factory production. More recent incidents involving Asos and the owner of Hobbs, Whistles and Phase Eight have added to concerns, while Swedish fashion retailer H&M investigates claims of a possible breach.
The attacks have demonstrated how quickly a digital security incident can affect everyday business operations, interrupt supply chains and expose customer information.
Susannah Streeter, chief investment strategist at Wealth Club, warned that companies could be leaving themselves vulnerable.
“Corporate defences are looking dangerously thin amid an onslaught of cyber attacks against businesses,” she said, adding that the latest incidents should serve as a serious warning to organisations facing increasingly advanced digital threats.
Marks & Spencer Counts the Cost of Its 2025 Cyber Attack
Marks & Spencer was among the British businesses hit hardest by a cyber attack during Easter 2025. The incident forced the retailer to suspend online clothing and homeware sales for approximately six weeks.
The disruption extended beyond its website, affecting supply chains and stock availability. Customers encountered gaps on supermarket shelves as the company worked to restore its systems and normal operations.
The financial consequences remained significant in the following financial year. M&S reported a 23.8% decline in adjusted pre-tax profits to £671.4 million for the year ending March 2026, with the cyber attack identified as a major contributor to the weaker performance.
The incident highlighted the potential scale of the damage when a retailer’s digital systems are disrupted, particularly when online sales, inventory management and distribution networks depend on interconnected technology.
Co-op Faces Store Disruption and Financial Pressure
The Co-op was another major retailer affected by a cyber attack in 2025, which caused widespread operational difficulties.
Some stores experienced problems processing card payments, while supply chain disruption contributed to shortages on shelves. The company faced the challenge of restoring its systems while maintaining services for customers.
The retailer subsequently reported underlying operating losses of £32 million for the six months to July 2025.
Although the financial results reflected the company’s wider operating position, the cyber incident added to the pressure by disrupting essential business functions and affecting the shopping experience.
Jaguar Land Rover Production Halted for Five Weeks
The consequences of a cyber attack were particularly severe for Jaguar Land Rover, where production at UK factories was halted for five weeks in September 2025.
The shutdown affected the luxury carmaker’s manufacturing operations and contributed to a revenue decline of more than £1 billion in its subsequent quarterly results. The company also recorded almost £200 million in additional costs associated with the incident.
The disruption demonstrated that cyber attacks are not limited to online retailers or businesses that handle customer transactions. Manufacturers can also face serious financial consequences when digital systems required to operate factories are compromised.
Harrods Also Experienced Cybersecurity Incidents
Luxury department store Harrods faced two cyber incidents during 2025, including an attempted intrusion that led the company to restrict internet access across its sites.
The retailer later indicated that the financial impact had been limited.
The incidents nevertheless added to a wider pattern of attacks and attempted breaches involving prominent UK businesses, highlighting the pressure on companies to protect their systems against both successful attacks and suspected intrusions.
Asos Confirms Unauthorised Access to Customer Information
Online fashion retailer Asos confirmed in October 2026 that an unauthorised party had accessed some customer information, including names and contact details.
The development followed alerts received by customers claiming that data storage provider Snowflake had been compromised. Snowflake said the breach was not caused by a vulnerability in its own platform.
Asos said payment card information and account passwords had not been compromised in the incident.
Although the information involved was more limited than payment credentials, exposed contact details can still create risks for customers. Criminals may use such information to make fraudulent messages appear genuine or to target individuals with personalised scams.
Hobbs, Whistles and Phase Eight Owner Reports IT Incident
TFG, the parent company behind womenswear brands Hobbs, Whistles and Phase Eight, confirmed that a cyber incident had affected certain information technology systems within its UK operations.
The company said there was no reason to believe payment information was at risk. Other brands within the group, including White Stuff, were not affected, according to the company’s statement.
The incident adds another major retail group to the list of businesses dealing with cybersecurity concerns, although the information released did not establish the full extent of the disruption.
H&M Investigates Claims Made by Hacking Group
Swedish fashion retailer H&M is investigating claims of a cyber attack involving the hacking group ShinyHunters.
The company said it had found no indication that its data environment had been compromised.
The distinction is important because claims made by hacking groups do not necessarily mean that an intrusion has been confirmed. Investigations are needed to establish whether systems were accessed, what information may have been affected and whether customers face any risk.
There is also no confirmed evidence that all the recent incidents involving major retailers are connected or were carried out by the same group.
Why Cybercriminals Target Major Retailers
Large retailers are attractive targets because they hold substantial amounts of customer data and depend on complex digital networks to manage sales, stock, payments and deliveries.
A successful attack can allow criminals to steal information, demand ransom payments or disrupt essential services. When systems used by warehouses, suppliers and shops are affected, the consequences can spread throughout a business rather than remaining confined to its website.
Not every attack requires criminals to defeat advanced security technology. Some exploit human weaknesses, including attempts to persuade employees to reveal login details or convince IT support teams to reset passwords.
The National Cyber Security Centre has previously warned about criminals impersonating staff to manipulate IT helpdesks into resetting credentials. If successful, these tactics can provide access to sensitive corporate systems.
The range of incidents affecting retailers illustrates why businesses need to protect both their technology and the processes employees use to access it.
What the Attacks Mean for Shoppers
For customers, cyber incidents can lead to cancelled orders, delayed deliveries, unavailable products and difficulties making payments. In more serious cases, they can also expose personal information to criminals.
Even when passwords and payment card details remain secure, stolen names, email addresses and telephone numbers may be used in convincing phishing attempts.
Customers affected by an incident should follow official updates from the retailer and remain alert to unexpected emails or text messages claiming to offer refunds, resolve delivery problems or verify account details.
The Information Commissioner’s Office advises people to use strong, unique passwords and take care when responding to messages requesting personal information.
Shoppers should avoid clicking suspicious links or sharing sensitive details in response to unsolicited communications. Where an account may be affected, customers should use the retailer’s official website or customer service channels to check the situation.
Retailers Face Growing Pressure to Strengthen Defences
The latest incidents come as businesses prepare for the busy Christmas shopping period, when retailers typically depend heavily on reliable online services, payment systems and supply chains.
The disruption experienced by M&S, Co-op and Jaguar Land Rover shows that cyber attacks can have consequences extending far beyond the immediate loss of access to computer systems. Newer incidents involving Asos, TFG’s fashion brands and claims concerning H&M suggest that cybersecurity remains a pressing concern across the sector.
Experts say companies must treat these events as a warning about the risks posed by increasingly sophisticated digital threats.
For retailers, protecting customer information and keeping operations running are now closely connected challenges. For shoppers, the incidents are a reminder to remain cautious about unexpected messages and to pay attention to security updates from the companies they use.
