The difference between them isn't size or budget. It's mostly a handful of boring things done in advance.
What happened
On 11 October, TFG London (the UK arm of The Foschini Group, which owns Hobbs, Phase Eight and Whistles) discovered a cyber security incident. Two days later several systems were still unavailable, and customers were told that orders placed on or after that Sunday might be delayed. The Register reported that TFG had activated its incident response and business continuity plans, brought in outside specialists and reported it to the ICO.
The bit that caught my eye: the shops stayed open. In TFG's words, "Stores are open as normal but some of our brand's website capabilities may not be available as the investigation continues." Payments run through a third party, and TFG said it had no reason to believe card details were at risk. Its other businesses, which run on separate IT systems, weren't affected. TFG hasn't said how the attackers got in, and I'm not going to guess.
The second story is a lot smaller and a lot sadder. A construction company's new finance director asked a security firm for help. The owner turned it down because, as he put it, a relative already did his IT. Three weeks later they were hit by ransomware. Their key data lived on an old, unpatched Windows server, and their only backup was an external drive plugged into that same server. Both got encrypted. They couldn't pay staff or work out who owed them money, and the business closed within months.
One of those businesses had a plan. One had a drive plugged into the thing it was meant to protect.
You don't need an IT department to do the basics
Most of the small businesses we work with don't have an IT department, and that's fine. You don't need one to get the essentials right. You need someone to own them, and you need to actually do them. Here's the short list.
1. A backup the attacker can't reach, that you've restored
If your backup is connected to the machine it's backing up, it isn't a backup. It's a second copy waiting to be encrypted. You want at least one copy that's offline or in a separate account that your everyday logins can't touch.
And then test it. Properly. Pick a day, restore last night's backup to a spare machine, and see if you can actually open the orders, the stock file and the accounts. Most people who find out their backups don't work find out on the worst day of their year. We've written a plain guide on how to test your backups if you want a checklist.
2. Two-factor login on everything that matters
Email, Shopify admin, your accounting software, your bank, your 3PL portal, your domain registrar. If someone can log in with just a password, assume one day they will. A code on a phone is far better than nothing. A passkey or a hardware key is better still, because it can't be phished by a fake login page.
This costs nothing but an afternoon of mild irritation.
3. Patch the boxes on the edge
The firewall, the VPN, the old server in the cupboard, the NAS that nobody's logged into since 2019. These are the things attackers go looking for, because they face the internet and nobody's watching them. In the past week alone, Ivanti and Cisco have both warned about holes in their VPN and email gateway products that attackers are already using.
If you don't know what's on your network, that's the first job. If something's too old to get updates, it needs replacing or unplugging.
4. Know what talks to what
A typical fashion or ecommerce business has a web store, a stock system, an ERP or accounts package, a warehouse or 3PL, a couple of marketplaces and a pile of integrations gluing them together. When one goes down, which others stop?
Draw it on one sheet of paper. Every system, what it feeds and who has the login. It's the single most useful thing you can have in your hand when something breaks, and it's how you decide what to switch off first. We spend a lot of our time building and fixing those integrations for fashion and ecommerce brands, and the businesses that have this map recover far quicker than the ones that don't.
5. A plan for taking orders by hand
TFG kept its shops open. Could you keep selling if your back office disappeared tomorrow morning?
Work out the manual version now, while it's calm. Can your web store keep taking orders if the stock sync is off? Can you export orders to a spreadsheet and send them to the warehouse by email? Who rings the 3PL? What do you tell customers, and who writes it? Half a page is enough. The point is that nobody has to invent it at 7am with the phones ringing.
6. Check who else has the keys
Suppliers, agencies, freelancers, the 3PL, the developer who built your site five years ago. Lots of businesses have more people with admin access than they have staff. Go through the user lists on your main systems, take out anyone who's left, and make sure the ones who stay are using two-factor too.
Being too small isn't a defence
The construction firm's owner thought they were too small to bother with. Ransomware doesn't really care. Most of it is automated, it finds whatever's unpatched and exposed, and it doesn't check your turnover first.
None of the above is glamorous, and none of it needs a big budget. It's mostly a few days of someone sensible going through it, plus a bit of discipline afterwards. If you want a framework to hang it on, Cyber Essentials covers a lot of the same ground and gives you a certificate at the end.
If you'd rather someone else did it
This is exactly the kind of thing we pick up for businesses that don't have their own tech team: backups that get tested, logins locked down, the old server dealt with, and a map of what talks to what. If that sounds useful, have a look at your tech department or just get in touch. Jason and I are happy to have a look and tell you honestly where you stand.
Cheers, Rob
