What: John Lewis Partnership, owner of the John Lewis department stores and Waitrose, has agreed a landmark recognition deal with Usdaw as UK employment law changes give trade unions increased rights of workplace access.

Why it is important: The deal formalises worker consultation at an employee-owned retailer under cost pressure, without extending to pay. It sets a template for how large UK retailers can accommodate unions on their own terms.

The John Lewis Partnership, owner of the John Lewis department stores and Waitrose, has agreed its first collective bargaining agreement with a trade union in almost 100 years. The deal is with shopworkers' union Usdaw and covers collective consultation on issues such as redundancies, health and safety, equality and training across the Partnership. Staff terms and conditions, including pay, are excluded.

John Lewis chiefs moved proactively as changes to employment law introduced by the Labour government come into force, giving trade unions increased rights to workplace access. The decision will likely increase the chances of other big retailers following suit. Usdaw, which has longstanding relationships with some other big retailers, notably Tesco, urged them to engage with it.

Chair Jason Tarry said the agreement will sit alongside the Partnership's commitment to democratic principles and complement its existing democratic structures, with the Partnership Council and forums remaining the cornerstone of employee voice. Usdaw general secretary Joanne Thomas said the union already has members in the business and looks forward to growing its membership and finalising how the agreement will work in practice. Employees are under no obligation to join Usdaw and remain free to join any union.

IADS Notes: The new agreement's scope over collective consultation on redundancies comes as John Lewis Partnership simplifies its head office, with redundancies so far affecting under 1% of the workforce. Chair Jason Tarry has said further cuts are not a one-off, with redeployment and natural wastage preferred and departures a last resort (Drapers, September 2026). Cost pressure is set to intensify ahead of the UK Budget. Tarry names business rates as the Partnership's largest cost, ahead of rent, and warns that a further tax rise on large stores would push retailers to look first at their most expensive operations, their stores (Drapers, October 2026).

John Lewis strikes landmark trade union recognition deal

What: Danish department store Magasin du Nord confirmed a ransomware attack that encrypted parts of its IT systems and exposed the names, contact details, addresses and purchase histories of its customers, including all Goodie loyalty club members.

Why it is important: The attack shows that a department store can keep its stores and online shop running while internal systems are encrypted. Recovery from such incidents typically takes months rather than days, and Co-op's chief executive stepped down as the costs of its attack mounted.

Copenhagen department store Magasin du Nord has been hit by ransomware. In an email, the company said unauthorised persons gained access to some of its IT systems a few days ago and made them unavailable by encrypting parts of them. Employees can no longer reach the affected systems.

The attackers accessed customers' names, contact details, addresses and purchase histories, including the data of all customers linked to the Goodie loyalty club. In a message to Goodie members, Magasin warned that the information could make phishing attempts more convincing and urged recipients to treat messages, emails and phone calls critically.

The attack did not block the systems central to running the store or those behind the online shop and website. Magasin reported the personal data leak to the Danish Data Protection Agency and the police, and said it is working with external experts to handle the incident and restore access to its systems. No ransom demand, attacker identity or number of affected customers is given.

IADS Notes: The ransomware attack at Magasin du Nord follows a run of retail incidents in which customer data became the main point of leverage. At Asos, a hacker who impersonated a trusted contact obtained an employee's credentials and reached customers' names and contact details on third-party platforms (Reuters, October 2026). De Bijenkorf warned shoppers of heightened phishing risk after a cyberattack on logistics partner CEVA exposed their names, addresses and contact details, and the incident also delayed orders, returns and refunds (nu.nl, September 2026). The operational cost of such events is considerable: in a survey of senior executives, 81% expected critical systems to be restored within 10 days of an attack, while real-world cases average three to six months, and only 35% regularly run real recovery exercises (Harvard Business Review, October 2026). The leadership consequences are visible at Co-op, whose chief executive is stepping down as the costs and disruption of a major cyber attack mount (Financial Times, March 2026). Regulatory exposure can be larger still: Coupang was fined $409 million after a breach of over 33 million customer records, alongside executive resignations and legal actions (Inside Retail, June 2026).

Magasin du Nord hit by ransomware, customer data leaked

What: Magasin du Nord kept all its stores and its webshop open after detecting unauthorised activity in parts of its internal IT systems on 18 October, while it investigates what personal data may have been affected.

Why it is important: Only 5% of Danish companies surveyed say they could largely carry out core activities without central IT. Magasin's ability to trade manually shows the value of a fallback that has been tested in practice.

On Sunday 18 October, Magasin du Nord detected unauthorised activity in parts of its IT systems, affecting a number of internal functions. Its security team, working with relevant authorities, worked to investigate the incident and limit its consequences.

Stores and the webshop stayed open. A few stores experienced startup difficulties on Sunday, with employees handling parts of the work manually, but all stores opened, while cash registers and online shopping kept running. CEO Peter Fabricius credited employees' flexibility and effort.

Magasin is still establishing the full extent of the incident, including which personal data on customers, employees and partners may have been affected. Payment card information was not part of the breach, as it is handled by Magasin's payment provider and not stored in the affected systems. The incident has been reported to the authorities, and affected groups are being informed directly.

A January 2026 survey by the Danish Confederation of Business found only 5% of surveyed member companies could largely carry out core activities without access to central IT systems. The Danish Chamber of Commerce described Magasin's experience as a relevant example for the entire Danish retail trade. Magasin plans to use the lessons in its preparedness work.

IADS Notes: Magasin's ability to keep trading stands in contrast to M&S, where a cyber attack forced a seven-week suspension of online sales and a £136mn profit hit (Financial Times, November 2025). The gap between expectation and reality remains wide: 81% of surveyed executives expect critical systems to be restored within 10 days of an attack, while real-world cases average three to six months, and only 35% of organisations regularly test recovery under real scenarios (Harvard Business Review, October 2026). Retail continues to be targeted at pace. In mid-October, attacks on refrigeration controllers spoiled stock across about 400 French supermarkets as Asos, TFG London and Ahold Delhaize reported separate incidents (The Robin Report, October 2026). Within days, H&M Group began investigating claims of an attack by the group linked to the Asos breach, in which customer names and contact details were accessed but no payment card information (Retail Week, October 2026). As at Magasin, keeping payment data out of the affected systems limited exposure at De Bijenkorf. There, an attack on logistics partner CEVA compromised customer personal data but not bank or card details, though it still delayed orders, returns and refunds (nu.nl, September 2026).

Magasin du Nord keeps stores and webshop open through IT incident