TFG London has confirmed a "cybersecurity incident" affecting some of its IT systems, and H&M Group may also have been targeted, in a double breach alert that industry observers say should "act as a wake-up call" for fashion retail and its supplier base.

The confirmation from TFG London — the UK arm of South Africa's The Foschini Group — puts two multi-market apparel retailers at the centre of the incident in the same news cycle. TFG London has said only that some of its IT systems have been hit; it has not disclosed the nature of the attack, the data involved, or the operational impact on its brands.

H&M Group's involvement is less certain. The Swedish retailer, which sources from suppliers across Asia and Europe, may have been targeted, but no confirmed statement of a breach has been reported. Practitioners should treat the two situations differently: TFG London's incident is a confirmed event; H&M Group's is an unconfirmed report.

Why does this matter beyond IT departments?

For sourcing and supply-chain teams, a retail-group cyber incident is rarely just an IT story. The systems that run order placement, EDI (electronic data interchange, the messaging layer between retailer and factory), invoices and shipment tracking often sit on the same corporate infrastructure. When those systems go dark or are isolated for forensics, the disruption lands on suppliers: orders pause, payments stall, production schedules slip.

Suppliers to either group should be checking now whether their own EDI links, order portals and accounts-receivable workflows are functioning, and whether any recent instructions arrived through channels that could have been compromised. Fraud follows outages — fake bank-change emails and spoofed payment requests are standard follow-on moves after a publicised incident.

What is confirmed and what is rumour?

• Confirmed: TFG London says a "cybersecurity incident" has affected some of its IT systems. It has not specified the attack type or data loss.
• Reported, not confirmed: H&M Group may have been targeted, according to the initial report. No breach statement from the company is on record.
• Sector reaction: commentators say the incidents should "act as a wake-up call" to retail on cyber readiness.

What should compliance teams do with this?

Under GDPR (the EU and UK's data protection law), a personal-data breach triggers a 72-hour notification clock to the regulator once the company becomes aware of it. If supplier or employee data is implicated, those notification duties — and eventual disclosure — will follow. For vendors, contract clauses on data handling and breach cooperation are worth re-reading this week.

For sourcing professionals, the practical read is simple. Cyber resilience is now a vendor-selection and continuity variable, sitting alongside audit status and capacity. Retailers will harden their systems; suppliers should expect questionnaires, tighter access controls on shared platforms, and faster incident-reporting expectations in renewed contracts.

The wake-up call framing is the right one. Confirm your exposure, verify your payment channels, and treat cybersecurity as a sourcing compliance line item — not an IT afterthought.