A cyber incident hit the owner of Hobbs and Whistles. The shops stayed open.
It's the second UK retailer in a week. The interesting part isn't the attack. It's how the business kept trading while it dealt with it, and what your business can copy.
What happened
On Sunday 11 October, TFG London, the UK business behind Phase Eight, Hobbs and Whistles, found a cyber incident affecting some of its IT systems. It brought in outside specialists, told the UK authorities, and said it had no reason to believe payment information was at risk. Whether any personal data was taken is still being investigated.
It follows the Asos breach confirmed the week before. Two well-known UK retailers in one week.
What they got right
We don't know yet how the attackers got in, and it's too early to judge the investigation. But the first response is worth noticing, because the shops stayed open.
- They kept trading. Stores carried on. Online orders placed before the incident were processed, and later ones were delayed rather than lost.
- They told customers exactly what to do. Don't resubmit your order. Returns can go back to a shop. A postal option is on its way.
- They called in help and told the authorities, rather than trying to handle it quietly.
None of that happens by luck. It happens because someone thought about it before the day it was needed.
Why this matters if you're not a fashion chain
Large retailers make the news. Most businesses don't, but they're hit far more often, and they have much less room to absorb a week without systems. The government's own figures put it at roughly half of UK small businesses suffering a cyber attack or breach in a year.
When it happens to a ten-person firm, the questions are the same as TFG's. Can we keep working? Who do we call? What do we tell customers? Do we have to report it? The difference is whether you answer them in a panic or from a plan.
The one-page plan to write this week
- Who to call, and how. Your IT support, your incident response contact, your insurer's helpline and your bank's fraud line. Write the numbers down somewhere that isn't on the computer that might be locked.
- How to keep trading for a few days. Can you take payments, answer the phone and serve customers if email and your main system are down? Paper forms and a spare laptop count.
- Whether your backups would actually save you. Kept separate from your main systems, so ransomware can't reach them, and tested by restoring something recently.
- What you'd tell customers. Draft a short, honest holding message now: what's affected, what they need to do, and when you'll update them.
- Who you'd need to tell. If personal data might be involved, you may have 72 hours to report it to the ICO. Your insurer will usually want to hear from you before you do anything else.
Keep it to one page, print it, and make sure at least two people know where it is.
If it's happening now
Disconnect affected machines from the network, but don't switch them off or wipe anything, as that can destroy the evidence of what happened. Then get help, for example through my cyber incident response.
Sources
Would you know what to do first?
I'll help you put a one-page plan together, or pick up the phone if it's already happening.