TFG London Confirms Cyberattack on Hobbs, Whistles and Phase Eight as Retail Breach Wave Rolls On

The owner of three of Britain's best-known fashion labels confirmed this week that attackers have knocked parts of its online operation offline, three days after the company first spotted the intrusion. TFG London, the UK arm of South Africa's The Foschini Group, said on Tuesday, October 13, that it identified a cybersecurity incident on Sunday, October 11, affecting IT systems tied to the Phase Eight, Hobbs and Whistles brands. Physical stores stayed open and trading throughout, but several internal systems remained unavailable and shoppers faced disrupted website functions and possible order delays. No attacker has publicly claimed the breach, and the company says it still does not know whether customer or other sensitive data was taken.

A two-day path from detection to disclosure

According to the company's own account, TFG London identified the incident on Sunday and immediately activated its incident response and business continuity plans, bringing in external cybersecurity specialists to contain it. The formal disclosure came on Tuesday via a SENS notice on the Johannesburg Stock Exchange, where the parent group is listed: "On Sunday, 11 October, TFG London identified a cybersecurity incident affecting some of our IT systems, specifically impacting our Phase Eight, Hobbs, and Whistles brands," the statement said. Two days from detection to public disclosure is roughly in line with how recent UK retail breaches have played out, and the company told the BBC it was "actively investigating and working with external cyber security specialists." The incident was also reported to the relevant UK authorities.

What shoppers actually know, and what they don't

On the question every customer asks first, TFG London has been specific: there is "no reason to believe that payment information is at risk," because card payments for its UK brands are processed through an external payment provider rather than stored on the company's own systems. That is the same distinction Marks & Spencer and other recently breached UK retailers leaned on, separating operational disruption from the more serious question of whether payment data was exposed. On the broader question, the company is still investigating whether personal or other sensitive information was compromised, and has promised to notify affected individuals directly if the forensic review confirms it. Orders placed after October 11 may be delayed, and in an email to customers the company said it saw no need for shoppers to change their account login details at this stage, while advising patience as systems are brought back online "as quickly and safely as we can."

Three days in, the company can say what was hit. It cannot yet say what was taken. That gap is normal in a forensic investigation, and it is exactly where the risk lives.

Fragmented systems limited the blast radius

One detail in the disclosure matters more than it looks: the attack hit only three of TFG London's five UK brands. Inside Story and White Stuff were unaffected, and the group's operations in Africa and Australia "run on separate systems and are not affected," the company said. Fashion retailers tend to run a patchwork of e-commerce platforms, loyalty programs, warehouse management systems and third-party logistics integrations, each a potential point of entry. That same fragmentation appears to have contained this incident: the company's ability to keep the other brands and regions trading normally while isolating the three affected labels suggests its network segmentation held up. The stakes are not small. TFG London operates 649 outlets globally, with 290 stores and 359 concessions, and reported retail turnover of £488 million for the year to March 2026, a 29.4 percent rise, even as it posted a £21 million operating loss partly tied to an impairment at Phase Eight, according to trade press reporting.

Retail's brutal run continues

The timing adds TFG London to a grim procession. Attacks on Marks & Spencer, the Co-op and Harrods in 2025 disrupted operations for weeks and prompted the British government to warn that cybersecurity must be an "absolute priority" for companies. The TFG incident landed in the same week that rumors emerged of a hack claim against H&M by someone saying they were with the ShinyHunters group, and shortly after fashion retailer ASOS suffered a breach in which attackers used social engineering to steal an employee's login credentials and access customer names, contact details and account information, according to BleepingComputer's reporting. Retailers are attractive targets for reasons beyond opportunism: they hold rich caches of personal data with resale value on criminal marketplaces, names, addresses, purchase histories and loyalty details, regardless of whether the attacker's primary goal was a ransom payment or data theft. Notably, as of midweek, no ransomware group had publicly claimed the TFG London breach or posted to a leak site, which makes this look, for now, more like a contained IT disruption than an extortion play, though forensic reviews typically take weeks and the picture can change.

What to watch next

Under UK data protection rules, companies must report qualifying personal data breaches to the Information Commissioner's Office within 72 hours of becoming aware of them, and TFG said the relevant authorities had been informed. The harder question, what the attacker actually copied, viewed or took, can take investigators weeks of log analysis to answer, and the company has committed to a further stock exchange announcement if there are material developments. For customers of Hobbs, Whistles and Phase Eight, the practical advice is unchanged from every retail breach of the past two years: remain alert for phishing emails and texts impersonating order updates or refund offers, since breach news is itself prime material for social engineering. The pattern across this wave of attacks is consistent. Retailers find the intrusion fast, disclose it within days, and spend the following weeks learning what the attackers really did while they were inside.