TFG London, the UK business behind Hobbs, Whistles and Phase Eight, is dealing with a cyber incident that has left several IT systems offline and online orders running late. The ICO has received a breach report, and the company has yet to say whether customer data was taken.
What happened
TFG London is the British division of the Cape Town-based retailer The Foschini Group (TFG). It found a cyber security incident on Sunday 11 October 2026, which hit the systems behind three of its brands: Phase Eight, Hobbs and Whistles. On Tuesday 13 October, the group told investors through the Johannesburg Stock Exchange’s news service, and it has since briefed the BBC and other outlets.
The shops are trading as usual, but parts of the three brands’ websites are not working. Customers have been warned that orders placed from Sunday onwards may arrive late and asked not to resubmit orders that look stuck. TFG says it invoked its incident and continuity playbooks, hired external specialists and informed the relevant UK authorities. The Information Commissioner’s Office told The Register it had “received a breach report from TFG Brands (London) Limited” and was assessing it.
The blast radius appears to be limited. TFG’s other UK businesses, White Stuff and Inside Story, are reported to be unaffected, and so are the group’s African and Australian businesses, which use different IT platforms.
What we do not know matters as much. The company has not said how the attackers got in, who they are, whether ransomware was deployed or data was stolen, or when systems will be fully restored. TFG told customers that a third party handles card payments and that, so far, it has no reason to think payment details are at risk. It also said customers do not need to change their passwords for now, and that anyone whose personal information turns out to be affected will be contacted directly.
The technical picture
With so little disclosed, it would be wrong to guess at the intrusion route, but the public details still say a lot.
First, this is an availability incident as well as a possible confidentiality one. Several systems were still down two days after discovery, and the order delays point to the e-commerce and fulfilment chain: order management, warehouse integration or the systems linking the two. TFG has not said whether systems were damaged or taken offline deliberately to contain the incident.
Second, the fact that White Stuff and Inside Story were spared suggests some separation within TFG’s UK estate. Muhammad Yahya Patel of Huntress told Infosecurity Magazine the pattern “suggests some degree of system separation was in place”.
Third, the payments point is narrower than it sounds. Outsourcing card processing to a payment service provider is good practice and keeps card data out of the retailer’s own systems. It does nothing for the names, addresses, email addresses, order histories and account records that a fashion retailer keeps itself. Those are exactly what extortion crews steal and threaten to publish.
According to The Record, this is the second cyber problem to touch TFG’s UK online sales this year. The group’s June results blamed part of a sharp fall in TFG London earnings on an incident at “a key online concession partner”. No link between the two has been suggested.
Why it matters for UK organisations
UK fashion retail is having a bad autumn. Asos customers received a push notification announcing that the retailer had been hacked, and it later emerged that more customer data was exposed than Asos first said. TFG London is the next mid-market name with a strong high street presence to report trouble. There is no evidence that the incidents are connected, and H&M’s separate investigation into an online claim remains unconfirmed. The pattern is still hard to ignore after the attacks on Marks & Spencer, Co-op and Harrods in 2025.
The message for retailers is that criminals have learned the sector is soft and time-sensitive. A fashion brand with its website down in the run-up to Christmas trading loses revenue every hour. That gives an extortion crew leverage even if no data has been taken.
There is a regulatory side too. Filing with the ICO this quickly is the right move. Under UK GDPR, a notifiable breach must be reported without undue delay and, where feasible, within 72 hours of the organisation becoming aware of it, even if the investigation is incomplete.
Expert view
In my experience, the detail that matters most in early statements like this is what has been contained, not what has been lost. TFG apparently kept the incident away from two sister brands and its overseas businesses. That is a real achievement and the payoff for segmentation work that is usually unglamorous and often cut from budgets. When we test retail groups that have grown by acquisition, we frequently find the opposite: shared Active Directory forests, flat networks between brands and service accounts that work everywhere. In those estates, one compromised brand means a compromised group.
I would be cautious about the line on not changing passwords. It is a reasonable holding position while the investigation runs, but customers who reused their Hobbs or Whistles password elsewhere should change it on those other services now. Fraudsters will also use the news for phishing. Expect convincing emails about “delayed orders” and “refunds” sent to customers of all three brands over the coming weeks, whether or not any data was taken.
The open question is extortion. If this follows the pattern of recent retail attacks, a leak site claim or ransom demand may surface within days.
What to do now
- Check your segmentation honestly. If you run several brands or business units, confirm that a compromise in one cannot reach the others through shared identity, management tooling or network routes. Use the firewalls and secure configuration controls from Cyber Essentials as a minimum, not a ceiling.
- Harden identity first. Enforce phishing-resistant MFA on administrative, remote access and help desk workflows, and review privileged and service accounts. This maps to the user access control requirements in Cyber Essentials.
- Rehearse an e-commerce outage. Run through your business continuity plan for losing order management or fulfilment for a week. Can stores keep trading, and can you tell customers what is happening?
- Protect and test backups. Keep offline or immutable copies of the systems that run your online trading, and test restoring them against a realistic recovery target.
- Prepare customer communications. Draft breach notices, phishing warnings and FAQs in advance, and agree who signs off the ICO report so the 72-hour clock does not catch you out.
- Customers of the affected brands: treat unexpected emails, texts or calls about orders and refunds with suspicion, and change any reused passwords.
Bottom line
TFG London has disclosed early, involved the ICO and appears to have kept the damage to three brands. That is better than many recent retail incidents. But with systems still down, no word on how the attackers got in and customer data not yet ruled out, this story is far from over. Every UK retailer should be asking whether its own estate would contain an attack this well.
Sources
- BBC News: Phase Eight and Hobbs owner hit by cyber-attack, as H&M probes separate hack claim
- The Record: South African clothing retailer Foschini Group investigating cyberattack on British fashion brands
- The Register: Owner of fashion brands Hobbs and Whistles joins autumn pwned collection
- Infosecurity Magazine: European Retail Firms Confirm Cyber Incidents
