Three major retailers attacked in one week: why eCommerce businesses should rethink peak season security

Within a week in October 2026, three significant retail cyber incidents came into view:

• ASOS: began investigating unauthorised activity on 6 October, later confirming that an unauthorised party obtained an employee's login credentials and accessed customer information through third-party platforms;

• TFG London: identified a cyberattack on 11 October and disclosed it on 13 October, affecting IT systems used by Phase Eight, Hobbs and Whistles;

• French supermarkets: experienced an attack overnight on 11–12 October targeting connected refrigeration systems at Intermarché and several other chains. Reuters reported that some fridge and freezer temperatures reached around 50°C, forcing stores to discard fresh and frozen food.

There is no evidence that these incidents were connected. But together they illustrate a pattern every eCommerce merchant should pay attention to heading into peak season: retail cyber risk extends beyond data theft and website disruption into third-party systems, employee access and operational technology.

The pattern is clear

The pattern across these incidents is that retail cyber risk spans employee accounts, third-party platforms and connected operational equipment. For merchants, protecting the storefront alone is not enough: security also needs to cover the people and systems that support daily operations.

TFG's attack affected a fashion retail group with multiple brands operating across physical and digital channels. ASOS's incident began with social engineering, when an attacker impersonated a trusted contact to obtain employee credentials and access information held on third-party platforms. The French supermarket attack represents a different vector entirely, targeting connected refrigeration controllers rather than customer databases or payment systems.

The wider retail data supports the need for attention. The Verizon 2026 DBIR retail snapshot, covering incidents from October 2024 to November 2025, recorded:

• Security incidents: 997 retail incidents, including 806 confirmed data breaches;

• Breach growth: nearly twice as many retail breaches as in the previous dataset;

• Attack patterns: system intrusion, web application attacks and social engineering accounting for 95% of confirmed retail breaches.

September also brought the StyleSmuggler zero-day, which affected versions of Adobe Commerce and Magento Open Source listed in Adobe's security bulletin and was being actively exploited before Adobe issued an emergency fix on 7 September. Adobe classified the vulnerability as critical.

Its remediation guidance requires affected merchants to apply the appropriate patch, then rotate encryption keys and associated credentials that could have been exposed. Rotating the encryption key alone does not invalidate credentials already obtained by an attacker.

UK retail also entered 2026 after the major 2025 attacks on Marks & Spencer, Co-op and Harrods. The French supermarket incident adds another dimension: connected operational equipment can become part of the same security conversation as storefronts, customer data and internal systems.

Why this matters more before peak season

Peak season concentrates sales, customer activity and operational dependency into a short period. A security incident during that window can therefore create more disruption than the same incident during a quieter trading period.

• Transaction volumes: more orders increase reliance on checkout, payment, fulfilment and customer systems. A disruption can affect more orders in a shorter period;

• Operational pressure: teams focused on fulfilment, inventory and customer service have less capacity for unexpected incidents. Unclear monitoring responsibilities and escalation routes can slow their response;

• Promotional activity: seasonal pages, integrations, new apps and quickly deployed functionality can introduce additional dependencies. Speed-to-market should not remove security review from the release process;

• Customer data volumes: new accounts, loyalty registrations and delivery addresses can increase with peak traffic, making access controls and third-party data handling particularly important.

The point isn't that peak season automatically causes attacks. It's that the commercial cost of disruption can be higher when systems are under their greatest operational pressure.

What eCommerce merchants should do now

The conventional advice to avoid unnecessary changes during peak season still makes sense. For security, however, a change freeze should not mean postponing critical patches, access reviews or incident preparation.

Audit your third-party risk

Third-party systems are a material part of the retail security picture. Verizon found third-party involvement in 68% of retail breaches in its 2026 dataset.

The ASOS incident provides a direct example. The attacker used compromised employee credentials to access information through third-party platforms used by the retailer.

Actions to take:

• Inventory: list the third-party apps, services, scripts and integrations connected to your storefront and customer data;

• Removal: remove anything no longer required;

• Permissions: review access to customer, order and admin information, and restrict each integration to what it actually needs;

• Storefront scripts: review your Content Security Policy, which controls the sources from which browsers can load scripts and other content, where your platform and implementation support it.

Enable continuous security monitoring

If security checks happen only occasionally, a compromise can exist between review cycles.

For Adobe Commerce and Magento Open Source merchants, Adobe's Security Scan Tool can run daily, weekly or on demand and checks stores for known security risks and malware. These scheduled scans are one layer of protection. Discuss file-integrity, log and infrastructure monitoring with your agency or security provider to establish ongoing coverage appropriate to your store's risks.

For Shopify merchants, review installed apps, user access and account security. Shopify provides controls for login history, staff permissions and two-step authentication, while Plus organisations can enforce secure sign-in methods across eligible users.

Action: confirm who is monitoring security alerts during peak, what triggers escalation and who has authority to act when something unusual appears.

Prepare an incident response plan

The retailers that respond effectively are the ones that know what happens next before an incident occurs.

This doesn't need to be a 50-page document. It needs to answer five questions:

• Who makes decisions during an incident?

• How will you communicate with customers?

• What's the process for restricting or taking systems offline if necessary?

• Who are your external security and platform contacts?

• How will critical trading operations continue during disruption?

TFG London said it activated its incident response and business continuity plans after identifying the attack, bringing in external cybersecurity specialists while affected systems were investigated.

Action: document those responsibilities, test the communication chain and confirm that external contacts are current before peak begins.

Review employee access and authentication

Many attacks do not begin with an obscure technical exploit. Credentials and human behaviour remain significant parts of the retail threat landscape.

ASOS confirmed that its October incident began when an attacker impersonated a trusted contact and obtained an employee's login credentials. Verizon's retail data also reports a human element in 58% of breaches in its dataset.

With seasonal staff joining during peak season, access management deserves particular attention.

Actions to take:

• Access review: audit admin and operational access across your eCommerce platform and connected systems;

• Authentication: require secure sign-in or multi-factor authentication where available;

• Former staff: remove access for employees who have left;

• Seasonal staff: grant only the permissions required for their roles.

Update your customer communication template

If customer data or service availability is affected, the first external communication is difficult to write well under pressure.

Action: prepare a draft incident communication covering what happened, what systems or information may be affected, what the business is doing and what customers should do next. Have the process reviewed by the appropriate legal or data-protection specialist, because notification requirements vary by jurisdiction and incident.

The template should accelerate a response, not replace the legal and factual review needed before anything is sent.

The bigger picture

The TFG London, ASOS and French supermarket incidents collectively illustrate something important: the threat landscape for retailers extends beyond traditional eCommerce security concerns.

The French attack shows how connected operational technology can create physical business losses. The TFG incident shows how an attack on shared systems can disrupt several brands at once. The ASOS breach shows how social engineering and third-party platforms can expose customer information without taking the core website or app offline.

For eCommerce merchants, the lesson isn't that security is impossible. It's that security is an operational discipline, not a technology purchase.

The merchants best prepared for peak are the ones continuously monitoring, patching, auditing access and testing how they will respond when something goes wrong.

Peak season is one of the worst times to discover that your security posture has gaps. Use the remaining preparation window to find those gaps before an attacker or an outage finds them for you.