TFG London: cyberattack hits Hobbs, Whistles and Phase Eight
IT systems offline and delayed orders at three British fashion brands owned by the Foschini Group. What is known, what is missing and what retailers should do.
TFG London, the British division of the South African group The Foschini Group (TFG), has suffered a cyberattack that knocked out several IT systems used by three fashion brands: Phase Eight, Hobbs and Whistles. The Register, The Record, BleepingComputer and Help Net Security all reported it, citing the company’s statement of 13 October 2026.
What happened
The company detected the incident on Sunday 11 October 2026 and disclosed it on Tuesday 13 in a statement to investors, published, according to The Record, through the Johannesburg Stock Exchange news service. The sources agree on these points:
- stores remain open, but several IT systems are still unavailable and some functions of the brands’ websites may not work;
- TFG London activated its incident response and business continuity plans, brought in external security specialists to contain the attack and informed the relevant UK authorities;
- the investigation has yet to establish whether personal or other sensitive information was compromised; the company will notify affected individuals and organisations if a breach is confirmed.
The Register reports that the ICO, the UK data protection regulator, confirmed it had received a breach report from TFG Brands (London) Limited and is assessing the information.
TFG London told customers that orders placed from Sunday onwards may be delayed (an email seen by The Telegraph, according to The Register) and, according to The Record, asked them not to place duplicate orders. Payments are handled by an external provider and, with the investigation still ongoing, the company has no reason to believe payment data is at risk. Only The Record reports that customers do not need to change their account password at this stage.
Scope of the incident
The attack affects only the three brands. TFG London’s other two brands, White Stuff and Inside Story, were not hit, nor were the operations of TFG Africa and TFG Australia, which run on separate IT systems.
According to BleepingComputer, as of mid-2026 TFG London had 649 retail locations and annual sales of £488 million. The group, headquartered in Cape Town, has nearly 5,000 stores in 18 countries and around 40 brands, according to The Record.
The Record also notes that earlier in 2026 the group’s online sales had been hit by a cyber incident at “a key online concession partner”, listed in the June results among the causes of an earnings drop of more than 65% at the London division. There is no indication of a link with the current attack.
What is not known
Public technical information is very limited:
- the company has not said how the attackers got in or whether ransomware was used;
- there are no CVEs, indicators of compromise or documented techniques;
- no group has claimed the attack: BleepingComputer found no public claim and Help Net Security writes that the perpetrators are unknown;
- there is no date for full recovery of the systems; TFG London did not answer The Register’s questions.
It is therefore not possible to describe the attack chain or map the incident to MITRE ATT&CK techniques without speculating.
The context: fashion in the crosshairs
The attack comes at a difficult time for fashion retailers. A few days earlier ASOS confirmed that an attacker had obtained an employee’s credentials by impersonating a trusted contact and had accessed third-party platforms holding customer data (we covered it in this article). H&M is looking into claims by someone saying they belong to ShinyHunters, but according to the company there is so far no sign of compromise. The Record also mentions the incidents at Levi Strauss and De Bijenkorf in August and, in 2025, those at Marks & Spencer, Harrods, Louis Vuitton, Mango and Co-op.
As The Register points out, no evidence links the TFG London attack to those at ASOS and H&M.
Impact for European and Italian companies
Two aspects of the case are useful for anyone running security in retail.
The first is system separation: the brands and regions with separate IT infrastructure remained operational. The second is store continuity: shops kept trading while several systems were down and, with payments handled by an external provider, the company currently has no reason to believe payment data is at risk.
Under the GDPR, a possible exposure of customer data must be assessed for notification to the supervisory authority within 72 hours, as TFG London did with the ICO; in Italy the authority is the Garante. Clothing retail is generally not among the NIS2 sectors (implemented in Italy by Legislative Decree 138/2024), whereas online marketplaces are among the digital providers covered by the directive.
What to do now
- Separate environments: brands, countries and sales channels with distinct identity domains, networks and administrative access, so that an intrusion does not spread to the whole group.
- Test store continuity: tills and payments that keep working when central systems are down, manual procedures for orders and returns, customer communications ready in advance.
- Protect credentials and the help desk: phishing-resistant authentication for privileged accounts and customer-facing SaaS platforms, identity verification through an independent channel before resetting passwords or MFA.
- Review suppliers: online concessions, e-commerce platforms, logistics and marketing, with limited access and access logs.
- Watch for anomalous access: new administrators, out-of-hours logins, data exports, antivirus being disabled.
- Warn customers: after an incident like this, as BleepingComputer advises, customers of the affected brands should expect phishing and social engineering attempts in the company’s name.
How ARXDOME helps
ARX Sentry collects logs and events from computers, servers and firewalls and, in the SOC pages dedicated to identities, shows privileged logins, night-time logins and account changes. ARX Shield isolates a suspicious machine from the network with one click, and ARX Expose flags exposed services, company accounts involved in breaches and domains similar to yours, which can be used for phishing against customers. ARX Trace collects the evidence to reconstruct what happened.
Last updated:
