After the breach, the scams. Four things to do this week.

What's happened

Earlier this month we covered the cyber incident at TFG London, the owner of Hobbs, Whistles and Phase Eight. The company spotted it on 11 October, some IT systems went down, and the shops stayed open.

This week, TFG London has contacted customers about the incident. Reports say the company is urging customers to be alert to unexpected emails, calls and text messages. It says it has found no evidence so far that login details or passwords were accessed, and card payments go through a separate payment provider. It hasn't said publicly exactly what information was involved or how many people are affected.

Why the warning matters more than the breach

For most people, the breach itself isn't the danger. What comes next is. Once criminals have names, email addresses, phone numbers or order details, they can send messages that sound exactly like the real company: "There's a problem with your recent order", "Your refund is ready, confirm your card", "We need to verify your account after the security incident".

That's why TFG is telling customers to be careful. And it's why this matters to your business even if you've never sold a dress. Your staff are customers of dozens of brands, and plenty of them read personal email on work devices or use their work address for shopping. A convincing scam message doesn't care which inbox it lands in.

What to do this week

1. Tell your team about it. A two-minute heads-up works: "If you get a message about a Hobbs, Whistles or Phase Eight order, or a refund, don't click. Go to the website yourself." The same goes for any brand that's been in the news for a breach.
2. Remind everyone that real details aren't proof. A message that knows your name and what you bought can still be a scam. That's the whole point of stealing the data. Our 30-second phishing check is a good one to share.
3. Make your own domain harder to fake. If your business was ever breached, scammers would pretend to be you. SPF, DKIM and DMARC stop them sending email that looks like it comes from your domain. You can check yours in seconds with our free email security checker.
4. Plan what you'd tell your customers. Notice what TFG did: a clear warning, and what to watch for. If it were you, decide in advance what you'd say, and tell people what you'll never ask them for, such as passwords or card details by email. And know whether you'd need to report it to the ICO.

If it happens to you

If someone in your business has already clicked a link or entered a password after a message like this, treat it as a cyber incident: change the password, sign the account out everywhere and check for new email forwarding rules. If you're not sure how far it's gone, get help before you start deleting anything.

Sources

• Retail Technology Innovation Hub: Phase Eight owner TFG London contacts customers following cyber attack
• BleepingComputer: TFG London cyberattack disrupts systems at Hobbs and Whistles retailers
• Help Net Security: Phase Eight, Hobbs and Whistles owner joins growing list of fashion retailers targeted by hackers