European Retail Firms Confirm Cyber Incidents

Several retail firms across Europe have confirmed cyber incidents that are causing operational disruptions.

On October 12, Netherlands-based multinational retail company Ahold Delhaize confirmed it was experiencing “a security issue” within its networks and had to take “some systems offline” to protect them.

The disruption was reported to affect three of the group’s brands, including supermarket chain Albert Heijn, operating in the Netherlands and Belgium, Dutch drugstore chain Etos and Dutch liquor store chain Gall & Gall.

The next day, Reuters reported that South African retail group The Foschini Group (TFG), owner of high-street fashion brands Hobbs and Whistles, was investigating a “cyber incident.”

The press agency said TFG became aware of an incident on October 11 affecting its UK subsidiary TFG London, with “certain IT systems” impacted.

Specifically, it was reported that the affected brands include Phase Eight and Hobbs and Whistles brands.

The South African group added there is “no reason to believe that payment information is at risk” at this stage. Other TFG high street brands, including Inside Story and White Stuff, are not affected.  The group’s TFG Africa and TFG Australia subsidiaries are also not experiencing any operational disruption.

TFG said it had reported the incident to the relevant UK authorities.

Commenting on this TFG incident, Muhammad Yahya Patel, vCISO and cybersecurity advisor for EMEA at Huntress, noted, “The fact that Inside Story and White Stuff within the same group were unaffected, and that TFG’s wider Africa and Australia operations were untouched, suggests some degree of system separation was in place. That separation, which limited the blast radius, is worth noting as a positive.”

Additionally, according to The Times, H&M is also examining information circulating online about a potential incident.

However, at the time of writing, the retailer said it had found no indication that its data environment had been compromised.

There is currently no indication that these incidents are in any way related to each other.

ASOS Confirms Scope of Cyber-Attack

The incidents come days after customers of UK fashion retailer ASOS received a strange push notification indicating the company was hacked.

While the firm confirmed the unauthorized intrusion into “third-party platforms” it uses to communicate with customers and that personal information including names and contact details and some non-personal account related information “have been accessed,” it reiterated, in its latest customer update, published on October 13, that no payment-card information or account passwords were impacted.  

The latest alerts also come as many supermarket chains in France are still dealing with a large-scale cyber-attack where attackers tampered with refrigeration controlling systems in the night between October 11 and 12, leading to the loss of a large amount of food products and financial losses estimated in hundreds of thousands of euros.