Key points
- TFG London detected the incident on October 11, 2026, and disclosed it to shareholders on October 13.
- IT systems for Phase Eight, Hobbs, and Whistles are disrupted, but Inside Story and White Stuff are unaffected.
- The company states payment information is not at risk, but customer data exposure is still under investigation.
The short version
- TFG London confirmed a cyberattack impacting IT infrastructure for three of its premium fashion brands.
- Physical retail locations remain open, but some website functions may be unavailable.
- External experts are assisting with containment, and UK authorities have been notified.
The details
TFG London, the UK subsidiary of South Africa’s The Foschini Group, detected a cybersecurity incident on October 11, 2026. The company disclosed the breach in a shareholder announcement on October 13. The attack disrupted IT systems supporting the Phase Eight, Hobbs, and Whistles brands. According to Cyber Security News, several systems remain unavailable. Physical stores continued trading during the disruption. The group activated its incident response and business continuity plans immediately. TFG London engaged external cybersecurity specialists to help contain the threat. The company also informed relevant UK authorities about the incident.
The scope of the disruption is limited to the three affected brands. Inside Story and White Stuff were not impacted. Operations in Africa and Australia also remained unaffected because they operate on separate systems. This distinction is significant when assessing the incident’s impact across the broader retail group. TFG London stated it has no reason to believe payment information is at risk. A third-party provider handles payment processing. However, the company has not ruled out the exposure of other customer information.
The context
The investigation into potential data compromise is ongoing. TFG London said it will notify affected individuals or organizations if data is found to be compromised. The company has not disclosed the attackers’ identity or their entry point. It also did not specify whether ransomware was involved or if data was stolen. GBHackers noted that the announcement highlights system availability concerns while leaving data confidentiality unresolved. Orders placed on or after October 11 could be delayed. Customers have been advised not to resubmit those orders. Purchases placed before Sunday are expected to process normally.
This incident follows other recent disruptions in the retail sector. ASOS suffered a data breach after hackers used social engineering to steal employee credentials. Rumors also emerged about a potential attack on H&M, though the company found no evidence of a breach. TFG London’s June financial results mentioned an earlier cyber incident affecting a key online concession partner. That previous disruption contributed to pressures on its UK portfolio. Adjusted operating profit fell significantly, though this figure should not be attributed to the October attack.
What to watch
- Monitor official communications from TFG London for updates on system restoration timelines.
- Watch for notifications regarding potential exposure of personal customer data.
- Observe whether the investigation reveals the specific attack vector or threat actor.
- Note any changes in service availability for online ordering and account management.
What it means for organisations
Organisations should verify that their incident response plans include clear communication protocols for partial system outages. Teams usually need to confirm whether third-party service providers, such as payment processors, are isolated from internal network breaches. Check whether your business continuity strategies account for scenarios where physical operations continue while digital services fail. Ensure that internal stakeholders understand the distinction between system availability and data confidentiality. Communicate clearly with customers about what services are disrupted and what data may be at risk.
What to do and how to stay safe
- Monitor your email and spam folder for official notifications from TFG London regarding data exposure.
- Review recent orders placed on or after October 11 to check for processing delays or duplicate charges.
- Remain alert for phishing attempts that may reference this incident or ask for account verification.
- Do not resubmit orders that are currently being processed, as this may cause further delays.
Step-by-step guide: Secure Home Routers for Small Business Networks
General security guidance from the TechSec Headlines newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which brands were affected by the TFG London cyberattack?
The incident impacted IT systems for Phase Eight, Hobbs, and Whistles. Inside Story and White Stuff were not affected.
Is customer payment data at risk?
TFG London states it has no reason to believe payment information is at risk, as a third-party provider handles processing.
