What your agency probably didn’t tell you this October
By the end of October, most of the ecommerce industry news that really matters to retailers is news about peak. Black Friday plans are largely set, early promotions are already live, and anything that hasn’t been checked by now tends to get tested by real customers instead.
This roundup brings together the month’s Friday Five stories and what they mean for retailers heading into the busiest weeks of the year.
Five weeks, 25 stories your agency probably didn’t tell you.
Security had its busiest month of the year
Thousands of ASOS shoppers got an in-app push notification reading “ASOS hacked”, linking to a Telegram account that claimed to have compromised the retailer’s Snowflake instance.
ASOS confirmed names and contact details may have been accessed, but found no sign of payment data or passwords being touched. Snowflake equally reported no breach on its own side.
Shares fell more than 10% before anyone could confirm whether the claim was even real.
The detail that really matters for every other retailer is the channel the attacker used. The attacker used the ASOS app, which is a stark reminder that whoever can post to your app, your site or your customer emails can speak to your entire customer base.
At the end of this month, two critical vulnerabilities were found in PHP, the programming language Magento (and other platforms) are built on: PHP2Shell.
The flaws were discovered by security researchers using AI, and a patch soon followed. But once the vulnerabilities were made public, attackers moved just as quickly, and attempts to exploit them started in hours.
For retailers, that leaves very little time between a fix being released, and someone trying to use a flaw against an unpatched site.
The UK’s National Cyber Security Centre said the flaws affect every version of PHP and could let attackers run commands on any web server running it. Where neither the update nor PHP’s temporary fixes could go on quickly, it said to consider taking the system offline. That includes anything your suppliers host for you.
Earlier in October, TFG London (owner of Hobbs, Whistles and Phase Eight) also experienced a cyber attack. Some website features went down while it investigated. Orders were delayed and returns moved to stores until postal returns were sorted – all stores kept trading.
Not every outage, however, is an attack.
A power failure in one of Google Cloud’s three London zones on 20 October disrupted services for around eight hours. Royal Mail, DPD, Screwfix, Lloyds and HSBC were among the organisations affected, so retailers with nothing on Google may have still felt it through their carriers and banks.
All of this landed a month after StyleSmuggler, the Magento and Adobe Commerce zero-day that moved from first hit to fully backdoored in under an hour.
AI is helping people find vulnerabilities faster – on both sides.
Knowing which PHP version you run, and what else is out of date, makes it much easier to respond when the next one lands. Keeping a site and the platform underneath it up to date is a business as usual habit, week in, week out. We’ve written about why tech debt has become a security question here.
Black Friday pricing is being checked by regulators & shoppers
The Competition and Markets Authority fined Wayfair £4.8 million over its sales tactics.
The retailer had been running daily deals and 24-hour flash deals with countdown timers attached. When the timers ran out, many of the products stayed at the same price. Some even got cheaper.
Fake limited-time offers like these are now banned outright in the UK.
In fact, the CMA can fine businesses up to 10% of their global turnover for using them. With Black Friday only weeks away, that applies to every countdown timer and “ends tonight” banner retailers are planning to run.
The rules are tightening in the EU too. The European Parliament’s research service expects the European Commission to propose the Digital Fairness Act in mid-November.
The act is likely to cover personalised pricing and dark patterns, alongside influencer marketing and subscriptions that are hard to cancel.
For UK retailers selling into the EU, that means more rules on how prices and offers can be presented.
Shoppers are questioning Black Friday discounts too. Almost half of likely Black Friday shoppers told YouGov they find it hard to tell whether a discount is genuine.
More of them are turning to AI to check.
A third plan to use an AI assistant during this year’s sales, up from 19% last year, and finding the best price is the main reason.
However, those same AI assistants don’t always get it right. When Which? tested ChatGPT on 25 products, it found the lowest price and the right retailer for only eight of them.
More than two-thirds of its answers contained at least one error, such as an out-of-date price or the wrong retailer.
Even so, 29% of the Which? members surveyed said they’d use AI to hunt for deals. That means the price a shopper sees in an AI answer may not be the one on your site.
AI agents are moving from browsing to buying
Adobe expects AI-driven visits to US retail sites to rise by 130% this season, after growing 127% in August alone. Those are visitors retailers want: 69% of shoppers say they’re less likely to return something an AI assistant helped them choose. UK shoppers use the same tools, so the pattern travels.
The infrastructure is catching up. Meta and Sierra have proposed an open standard for how personal AI agents identify themselves to a business, with Stripe, Walmart and others signed on as early partners.
The aim is a common way to tell a browsing agent from a buying one, and a real person from both, in place of today’s one-off integrations. It’s still a proposal, so adoption by other agent providers is an open question. Visa and Mastercard have both announced agent-payment tools this year too.
Retailers expect the shift, but few feel ready for it. BCG surveyed 150 of the world’s biggest retailers and brands, and 68% expect agentic commerce to have a significant effect within two years.
Only 18% think their marketplaces are ready. Shoppers are further behind still: 53% of Europeans expect to use AI agents, yet just 4% would let one complete a purchase alone.
That echoes September’s finding that only 9% of UK shoppers trust an agent to buy on their own.
Which brands those agents recommend is a different question. IMRG mapped where homeware brands appear in AI-generated answers, and how shoppers move between AI, search, social and a website before they buy. Much of the gap between brands AI keeps surfacing and those it skips came down to content and product data, rather than brand size.
That matches September’s finding that feed quality is starting to outweigh the page itself, and it’s why we think the tool is the last question you ask.
Google is also asking for honesty about how product content gets made. Google’s Merchant Center rules say product titles and descriptions written with generative AI belong in its structured title and description attributes, marked as AI-generated, and AI-created images need the metadata that identifies them.
Checkout and delivery are where orders slip away
A survey of 2,000 UK adults commissioned by Brite Payments found 47% experience checkout rage when paying online, and one in six has sworn or shouted at the screen.
One in five would blacklist a retailer over poor payment options, and roughly one in ten shoppers who hit a failed payment switched retailer rather than try again.
Brite puts the time the UK spends filling in checkout forms at more than 55 million hours a year.
Delivery tells a similar story. Retail Economics and Metapack surveyed 400 retail leaders and more than 8,000 shoppers across eight markets. Seven in ten retailers expect online growth next year, and more than half of shoppers now expect standard delivery within two days.
A third of European retailers call AI adoption their biggest delivery challenge. Orders disappear in the gap between what shoppers expect and what a checkout can promise.
October’s ecommerce industry news in numbers
The short-term and long-term pictures pulled in different directions this month.
In the short term, shoppers feel steadier but aren’t spending more. KPMG’s confidence tracker found 56% of Britons feel financially secure, slightly ahead of last quarter, but 37% don’t expect to spend more than they did over summer. Barclays card data put online spend up 1.7% in September, against 2.3% face to face, with clothing down 1.3% and sports and outdoor down 3.3%.
Ahead of the Budget, 68% of shoppers said they were worried about what it meant for their finances, and 27% were putting off big purchases until it was out.
In the long term, the runway is still there. Forrester forecasts UK ecommerce reaching £176bn by 2029, taking online’s share of UK retail to 32%, the highest of the five major European markets it tracks. Offline growth across the region slows to 1.7% a year by comparison.
Most marketplace sales in Europe now cross a border. Cross-Border Commerce Europe’s latest top 100 puts Europe’s leading marketplaces at €175.8bn in sales this year, with €139.8bn of that, 79.5%, coming from cross-border transactions. It expects cross-border sales to grow 10% to €154bn in 2027. Testing bestsellers on a market’s leading marketplace is a cheaper first step than building a local site.
And TikTok says 300,000 UK small businesses now sell through TikTok Shop, with LIVE Shopping sales up 55% year on year, more than 6,000 live sessions a day in the UK, and one seller taking £100,000 in a single session. They’re self-reported figures, but the volume says something about where attention is moving.
From JH this month
Jamie’s pieces in October took a step back from the headlines. One looked at growing the customers you already have before chasing new ones, drawing on two Meet Magento UK speakers from very different fields. Another set out four decisions from Meet Magento UK 2026 to revisit: payments, the growth model, how you sell, and how readable you are to AI agents.
The Calm Advantage also began, with part one asking teams to fix their peak baseline now, so they know what a normal week looks like before the October promotions turn into November.
Part two followed at the end of the month with a 35-minute pre-mortem for peak. It gets the people who own checkout, fulfilment and customer service in one room to give five friction points a likely failure, an early-warning number and an owner, before Black Friday finds them first.