TFG London confirms cyber attack on Hobbs, Whistles, Phase Eight; payment data not at risk

The owner of fashion brands Hobbs, Whistles, and Phase Eight has confirmed a cybersecurity incident, warning customers of potential disruption but stating that payment card data is not believed to be at risk.

South African retail group The Foschini Group (TFG) said it became aware of the incident on Sunday, October 11, affecting its UK subsidiary TFG London. The attack impacted “certain of its IT systems” specifically for the Phase Eight, Hobbs, and Whistles brands, the company said in a statement.

TFG said there is “no reason to believe that payment information is at risk.” Other brands in the group’s portfolio — Inside Story and White Stuff — were not affected. Operations in TFG Africa and TFG Australia also remained unaffected.

The incident has been reported to the Information Commissioner’s Office (ICO), the UK’s data watchdog, which said it is “assessing the information provided.” Organisations must report personal data breaches to the ICO within 72 hours of becoming aware of them, unless the breach poses no risk to individuals’ rights and freedoms.

Stores remain open, but some website capabilities for the affected brands may be unavailable while the investigation continues. Customers who placed orders before Sunday were told their purchases would be processed and delivered as normal. TFG London said there could be delays for orders placed after Sunday, but added there is no need to resubmit any orders. Returns can be made in stores, and the company said it is working on a solution for postal returns.

TFG London first entered the UK market in 2015 with the acquisition of Phase Eight, later adding Whistles, Hobbs, Inside Story, and White Stuff. The subsidiary is headquartered in London, employs more than 3,000 people, and operates across the UK, Europe, America, and Asia.

The attack comes a week after fast-fashion retailer Asos disclosed that an “unauthorised party” had accessed some personal data, including names and contact details. Asos customers received alerts linking the breach to data storage firm Snowflake, though Snowflake later said the incident was not caused by a vulnerability in its platform. On Monday, it was reported that Swedish fashion giant H&M was investigating a potential cybersecurity incident claimed by a group called Shinyhunters, according to The Times.

Industry experts warned that retailers are becoming an increasingly frequent target.

Lisa Barber, tech editor at consumer group Which?, said: “Shoppers will be deeply concerned to learn of these latest security breaches, particularly coming so soon after the Asos hack.” She advised consumers to use strong, unique passwords and enable two-factor authentication wherever possible.

Beverley Griffiths, senior lecturer in security and resilience at Bucks New University, said: “This is the second UK retailer to be hit in a week and it’s a clear sign that major brands are firmly in the crosshairs of cyber attackers. No organisation is immune, so the real test of resilience is how quickly a business can detect an incident, respond and recover while keeping its customers informed.”

Jonathon Ellison, director for national resilience at the National Cyber Security Centre (NCSC), said in a LinkedIn post: “The real-world consequences of cyber attacks can be shocking but they should be no revelation – malicious actors can and do inflict harm on businesses and individuals every day.” He added that the NCSC is engaging with the retail sector to promote sharing insights and strengthening cyber resilience.

Ade Clewlow, senior adviser at cybersecurity firm NCC Group, said retailers are becoming a particularly “attractive target” as the Black Friday sales and festive period approach. “Organisations need to understand where their data is held, who can access it and whether their suppliers meet appropriate security standards,” he said. “High profile retail companies need to have a better understanding of how threat actors target their sector, to better protect consumer data.”

TFG London said it is actively investigating the incident with the help of external cybersecurity specialists and will provide additional updates as appropriate.