Threat Analysis: UK Retail Under Attack, NetScaler Zero-Days, and the Password That Breached 8.8 Million Records
This is your Daily Threat Analysis for the 13th of October 2026.
Three stories today. One is a live UK incident. One is a pair of zero-days that are being exploited right now in production environments. One is a reminder, served up from Denmark, that the basics still break organisations at scale. None of them require a sophisticated threat actor. All of them require you to do something.
UK Retail Hit Again: TFG London Confirms Cyberattack
TFG London, the parent company of fashion brands Hobbs and Whistles, has confirmed a cyberattack that has taken several IT systems offline and is causing delays to customer orders. The incident was reported by The Register on the 13th of October 2026.
The statement from TFG London does not attribute the attack, does not confirm whether data was accessed, and does not give a timeline for recovery. That is the standard first-day posture and it tells us very little operationally, other than that systems are significantly impacted, not a minor disruption.
What it does tell us is that UK retail is having an extraordinarily bad autumn. This is the latest in a pattern of incidents targeting UK retailers. The sector has been a consistent target, and the attacks are not all from the same actor or using the same methods. What they share is that retail businesses, including their suppliers and logistics partners, are being selected as targets and successfully compromised.
What the statement does not say is anything about how the attackers got in. That matters, because the attack vector determines who else is at risk. If it is a phishing compromise of a privileged account, every business that shares a supply chain, logistics platform, or payment processor with TFG London should be paying attention. If it is an unpatched perimeter device, the same logic applies.
If your business supplies to, delivers for, or shares IT infrastructure with any major UK retailer, you need to be monitoring for unusual activity on shared systems and connections right now. You do not need to wait for attribution. The question to ask your IT provider is: do we have any integrations, data connections, or shared platforms with TFG London or its brands? If the answer is yes, review access logs for the past two weeks.
The NCSC has published guidance on supply chain cyber security. The fact that we are still watching UK retailers fall over in sequence tells you how far down the priority list that guidance sits for many organisations.
NetScaler Zero-Days: Active Exploitation, Right Now
This is the most technically urgent item in today’s brief.
Two zero-day vulnerabilities in Citrix NetScaler ADC and Gateway are being actively exploited in production environments. Unit 42 at Palo Alto Networks published their threat overview covering both flaws, which are tracked as CVE-2026-88771 and CVE-2026-88772.
Here is what each one does:
CVE-2026-88771 is a remote code execution vulnerability that allows unauthenticated command injection. An attacker does not need credentials. They do not need to have previously compromised anything in your environment. They point the exploit at a NetScaler device exposed to the internet and they get code execution. Threat actors have used this to deploy webshells, persistent backdoors that survive reboots and allow continued access long after the initial compromise.
CVE-2026-88772 is a DTLS memory overflow flaw that also enables remote code execution or denial of service. It affects the same product family.
Both vulnerabilities are being exploited now, not theoretically. Webshells have already been deployed through these vulnerabilities in confirmed incidents. That means the window between patch availability and widespread exploitation has already closed. If you have not patched, assume the risk is active, not pending.
Why this matters to UK SMBs specifically
NetScaler ADC and Gateway are widely deployed as network access and application delivery infrastructure. Many SMBs do not run NetScaler directly, but their managed service providers, cloud providers, or SaaS platforms may. This is a supply chain risk as much as it is a direct technical risk.
The question to ask your IT provider or MSP today is not “are we patched?” The question is: “do you run NetScaler ADC or Gateway anywhere in the infrastructure that handles our traffic, authentication, or remote access? If so, confirm in writing that you have applied the patches for CVE-2026-88771 and CVE-2026-88772 and that you have reviewed your logs for indicators of compromise.”
If your provider cannot answer that question today, that is your answer.
The advisory notes webshells as the persistence mechanism of choice in confirmed exploitation. Webshells are notoriously difficult to detect after the fact because they blend with legitimate web traffic. If your environment has any NetScaler exposure, an incident response review of web server logs is warranted even after patching.
Immediate actions:
- Identify whether your direct or MSP-managed infrastructure includes NetScaler ADC or Gateway.
- Confirm patches for CVE-2026-88771 and CVE-2026-88772 are applied.
- Request confirmation from your provider in writing, with a date.
- If you cannot confirm patch status, treat the device as potentially compromised and initiate a log review.
- Block internet-facing access to management interfaces as a precautionary measure until patching is confirmed.
‘123456’: The Password That Exposed 8.8 Million People
This story comes from Denmark, but every IT provider and SMB owner in the UK should read it slowly.
A small Danish IT company had access to Denmark’s national civil register, a database containing personal information on approximately 8.8 million people. That company’s systems were breached. According to local media reporting cited by The Register, three accounts at the firm were protected by weak passwords, with ‘123456’ specifically named.
There is no indication in the reporting of sophisticated attack tooling. No zero-days. No advanced persistent threat group. Someone used weak credentials to access a system that held sensitive data on a large portion of a country’s population.
The firm was small. It had privileged access. It had no meaningful password security.
Let that configuration sit with you for a moment.
The question this raises for UK SMBs
How many small IT companies, accountancy practices, HR software providers, or payroll processors have access to sensitive data belonging to your staff, your clients, or your supply chain, and how confident are you in their credential hygiene?
The UK’s data protection framework requires you to consider the security of data processors, not just your own internal controls. If a data processor you rely on is breached because one of their staff used a weak password on a privileged account, the ICO will want to know what due diligence you conducted.
The standard you are held to is reasonable steps, not perfect steps. But “we asked them once if they had a security policy” will not hold up if 8.8 million records are sitting behind ‘123456’.
What reasonable due diligence looks like:
- Include a security questionnaire in your supplier onboarding process. Ask specifically about MFA on privileged accounts.
- For suppliers with access to personal data, require annual confirmation that MFA is enforced on all accounts that can access your data or shared systems.
- Review your data processor agreements. They should specify minimum security standards. If they do not, update them.
- For high-risk suppliers, anyone with access to financial systems, HR data, or customer records, consider asking for Cyber Essentials certification as a baseline.
The NCSC has published guidance on supply chain security and supplier assurance. The fact that a breach of this scale can still be traced back to weak passwords at a small IT firm tells you everything about the gap between published guidance and actual implementation.
Today’s Wider Context: Refrigeration, SAP, and What Physical Systems Tell Us
Two additional items worth noting briefly.
In France, attackers compromised internet-connected refrigeration systems at hundreds of supermarkets, cranking temperatures up to 50°C and spoiling stock. The manufacturer confirmed to The Register that affected equipment was running outdated firmware. This is not a UK incident, but UK food retail and hospitality businesses use similar building management and refrigeration control systems, and the pattern, internet-connected operational technology running unpatched firmware, is not unique to France.
If your business has any internet-connected building management, HVAC, or refrigeration systems, check when the firmware was last updated. If your facilities management or equipment provider cannot answer that question, escalate it.
Separately, SAP published its October 2026 security update addressing 20 vulnerabilities, including a maximum-severity flaw in the Cloud SDK for Python. BleepingComputer has the detail. If your business runs SAP products, or your ERP provider does, confirm that the October patches have been applied.
Summary: What to Do Today
| Priority | Action |
|---|---|
| Immediate | Confirm NetScaler ADC/Gateway patch status with your IT provider for CVE-2026-88771 and CVE-2026-88772 |
| Today | If you supply to or integrate with UK retailers, review shared system access logs |
| This week | Audit supplier access to your sensitive data; confirm MFA is enforced on privileged accounts |
| This week | Apply SAP October 2026 patches if relevant to your environment |
| Ongoing | Check firmware update status on any internet-connected operational technology |
If Threat Analysis is useful to you, follow the show wherever you listen so tomorrow’s briefing lands automatically, and pass it to someone in your network who needs the heads-up. The small IT firm in Denmark almost certainly thought this sort of thing happened to other people.