FatFace

FatFace operates as a British clothing retailer, offering a range of apparel and fashion accessories to consumers across the United Kingdom and through online channels. The company focuses on providing casual and outdoor‑oriented clothing lines that cater to everyday wear and leisure activities. Its product portfolio includes items such as jackets, trousers, shirts, and knitwear designed for men, women, and children. FatFace distributes its goods through physical stores, an e‑commerce platform, and wholesale partnerships.

The organisation’s headquarters is located in the United Kingdom, which serves as the central hub for its corporate functions, including strategy, finance, and supply‑chain coordination. Being based in the UK allows FatFace to draw on local design talent and to respond quickly to regional fashion trends. The company’s UK presence also underpins its compliance with British consumer protection and data‑protection regulations.

On 17 January 2021, FatFace experienced a ransomware attack that began with a phishing email compromising an internal workstation, granting threat actors initial access to the corporate network. The attackers moved laterally within the environment, eventually exfiltrating more than 200 gigabytes of data that included customer names, contact information, and partial payment‑card details. After the data theft, the ransomware operators demanded an initial payment of approximately 8.5 million USD, which was later negotiated down to about 2 million USD before a settlement was reached. The incident prompted FatFace to engage law‑enforcement agencies and data‑protection authorities to investigate the breach and to begin remediation efforts.

Following the attack, FatFace issued breach‑notification emails to affected individuals, a communication that attracted public criticism because it requested recipients to keep the incident confidential. The threat actors, after providing the decryption key, also supplied the company with recommendations for improving its network security posture, such as patching vulnerabilities and enhancing employee awareness training. FatFace subsequently implemented a series of technical and organisational controls aimed at strengthening its defences against future ransomware and phishing threats. The company continues to monitor its systems and cooperate with regulators to ensure ongoing compliance with data‑protection obligations.