BySandra Halliday
Published October 16, 2026Reading time5 minutes
DownloadPrintText size
News analysis: Cyberattacks erode loyalty but vague responses make the situation worse
BySandra Halliday
Published
October 16, 2026
Cyberattacks are never good for a company’s image (let alone the bottom line) but the way businesses respond is crucial to regaining customer trust.
That’s according to analysts at GlobalData who criticised “vague brand responses” to the attacks of the past two weeks.
Recent high-profile cyber-attacks at ASOS and TFG London (owner of Hobbs, Phase Eight, and Whistles), as well as — perhaps — H&M (the latter is still investigating hacker claims that its data was breached but has so far found no evidence to support those claims).
Regardless, these attacks “illustrate the severe operational disruption facing the fashion retail industry,” GlobalData said. “The ongoing operational fallout highlights escalating security threats. With hackers utilising AI-driven methods to exploit corporate infrastructure, cyber-attack response is becoming a defining test of consumer trust for apparel brands”.
Chloe Tedford-Jones,apparel analyst at GlobalData, said: “Vague brand responses to cyber-attacks contrast with historical precedents. When Marks & Spencer [in 2025] detected an anomaly exposing customer details last spring, the brand took decisive action to limit the reputational and operational fallout.”
M&S quickly suspended all online transactions to secure its systems immediately, “whilst simultaneously stating the exact operational perimeter of the issue, clarifying which data and customer segments were affected. This rapid response and clear communication went some ways to prevent panic among consumers and can be credited with mitigating any long-term erosion of trust from consumers”.
But she said ASOS issued “unannounced mass password resets after many customers received an unexpected and ominous ASOS app notification, which stoked public fears of a wider system compromise. [And] TFG didn’t initially clarify which consumer segments were vulnerable across its brand portfolio, leading to reputational damage across its fascias”.
Tedford-Jones added that “in 2026, silent mitigation following cyberattacks has proven to backfire by eroding public trust faster than the technical hack itself. Apparel brands and retailers must treat cyberattack disclosure as brand governance, rather than mitigating damage to prevent company liability. Brands should quickly explain what is known, who may be affected and the measures being taken to secure accounts and services. Proactive and consistent communication is essential, whilst investment in robust cybersecurity is imperative as developments in AI will continue to multiply the threat.”
Of course, responses aside, the best form of defence is robust security that stops these attacks happening. The ASOS attack apparently was due to attackers obtaining an employee’s login credentials by impersonating a trusted contact.
And identity-centric security solutions specialist Entrust has released new findings showing 91% of 1,000 IT and security leaders it surveyed in the UK and US experienced workforce identity fraud or a near miss in the past two years.
Attackers are targeting employee identities through phishing and social engineering (46%) and compromised credentials (43%) to gain trusted access. And AI-enabled impersonation is outpacing measurement, creating a critical identity security gap.
It’s all particularly worrying for brands given that 80% of UK shoppers say they’d stop buying from a brand after a data breach.
That’s according to Usercentrics, a global consent management platform (CMP) provider that helps websites, mobile apps, and connected TV (CTV) apps collect, manage, and document user consent for cookies and data processing.
It said that “fashion is a category where switching is easy, so a security incident doesn’t just hit systems. It hits loyalty, and that’s much harder to rebuild. Shoppers now expect retailers to tailor the experience to them, which only works if they trust the brand with their data. Once that trust goes, the personalisation strategy goes with it.”
Claud Bilbao, VP, underwriting & distribution at insurance specialist Cowbell, thinks there’s a need for urgent action, saying: “Two cyber incidents hitting major fashion retailers in a matter of days should be a wake-up call for the entire sector. There’s no evidence the attacks are connected, but cybercriminals don’t need to take a retailer offline to inflict serious damage. Stealing customer data, disrupting orders or undermining consumer confidence can be just as costly. And with Black Friday and Christmas approaching, attackers know that retailers face enormous pressure to keep trading. That commercial pressure can become a weapon in the hands of cybercriminals, particularly when they’re looking to extort a business.”
And criminals are becoming masters at using those weapons. Camellia Chan, CEO of cybersecurity company X-PHY, said: “There was no getting away from this one. It didn’t sit in an inbox waiting to be read; it lit up the lock screens of app users, under the ASOS name, before the company itself had a statement out. That is what access to a retailer’s communication platforms buys an attacker: a verified, engaged audience with purchase history attached. A message about a problem with this week’s order sent under the retailer’s brand will convert where a cold phishing email never would. The retailer has, in effect, assembled and qualified the victim pool, and the attackers only needed to borrow the keys. The names and contact details that were taken extend that reach by email and SMS long after the platform itself has been locked down.”
She added that companies need to be ensuring the security of external companies they deal with is watertight too as so many businesses now rely on third-parties: “A digitally led fashion business runs its customer relationship through a stack of vendors for messaging, analytics, data and logistics, each holding legitimate credentials, and software controls cannot tell a trusted credential being used properly from one being abused. Software security remains essential, but it is inherently reactive and dependent on constant updates and human vigilance.
“The practical lesson is to assume the outer layers will be compromised at some point and make sure the core cannot be. Critical customer and transaction data should sit behind hardware-level protection that does not depend on the integrity of the software and vendor stack above it.
“High-volume fashion retailers can feel the commercial impact immediately. ASOS shares fell sharply as news of the incident emerged, showing how quickly a cyber event can affect confidence in the business. Once a warning arrives in the same channel as the order confirmations, every genuine message carries a question mark. That is the gap follow-up scams exploit, and it is where the longer-term damage to reputation and sales is done.
“Other retailers should be testing their own resilience now by mapping every third party that holds a key to their customers, reviewing what those credentials can reach, stress-testing recovery plans and ensuring cyber risk has clear ownership at board level. The priority is being able to detect, contain and recover from an attack quickly before it becomes a wider business crisis.”
