Data Breach at Hobbs and Whistles Owner Raises Retail Sector Cybersecurity Alarms

The owner of fashion brands Hobbs and Whistles has apologised to customers after a cyber attack hit its UK subsidiary, marking the second breach to affect a British retailer in seven days.

South African retail group The Foschini Group (TFG) said it became aware of the “cybersecurity incident” on Sunday, 11 October, affecting its UK unit TFG London. The attack targeted “certain of its IT systems” and specifically impacted the Phase Eight, Hobbs and Whistles brands, according to a statement reported by the Standard.

TFG said there is “no reason to believe that payment information is at risk.” Other high street brands in its portfolio, including Inside Story and White Stuff, are not affected. The company reported the incident to the relevant UK authorities and said its operations in TFG Africa and TFG Australia were not impacted.

The breach comes a week after fast-fashion retailer Asos said an “unauthorised party” gained access to some personal data, including names and contact details. Asos customers were alerted that the data storage firm Snowflake had been compromised; Snowflake later said the breach was not caused by a vulnerability or flaw with its platform.

On Monday, the Standard reported that H&M was investigating claims it was targeted by a cybercriminal last week. The Swedish fashion giant said it was looking into a potential incident made by a group called Shinyhunters.

TFG London said stores remain open as normal, but some website capabilities for the affected brands may not be available while the investigation continues. Customers who placed orders before Sunday were told their purchases would be processed and delivered as normal. Orders placed after Sunday may face delays, but the company said there is no need to resubmit anything. Returns can be made in stores, and TFG London said it is working on a solution for postal returns.

The hack was reported to the Information Commissioner’s Office (ICO), the UK’s independent data watchdog, which said it was “assessing the information provided.” Organisations must report personal data breaches to the ICO within 72 hours of becoming aware of them, unless they do not pose a risk to people’s rights and freedoms.

TFG London first entered the UK market in 2015 after buying Phase Eight and has since added womenswear brands Whistles and Hobbs, homeware brand Inside Story and lifestyle brand White Stuff. Headquartered in London, the subsidiary employs more than 3,000 people and operates across the UK, Europe, America and Asia.

Security experts warned that the retail sector is becoming an increasingly attractive target. The Standard quoted Lisa Barber, Which? tech editor, as saying: “Shoppers will be deeply concerned to learn of these latest security breaches, particularly coming so soon after the Asos hack.” She added that consumers should use strong, unique passwords and enable two-factor authentication.

Beverley Griffiths, senior lecturer in security and resilience at Bucks New University, told the Standard: “This is the second UK retailer to be hit in a week and it’s a clear sign that major brands are firmly in the crosshairs of cyber attackers. No organisation is immune, so the real test of resilience is how quickly a business can detect an incident, respond and recover while keeping its customers informed.”

Jonathon Ellison, director for national resilience at the National Cyber Security Centre (NCSC), said in a LinkedIn post reported by the Standard: “The real-world consequences of cyber attacks can be shocking but they should be no revelation – malicious actors can and do inflict harm on businesses and individuals every day.” He added that the NCSC is engaging with the retail sector through existing trusted networks and urged all organisations to bolster their cyber defences.

Ade Clewlow, senior adviser at cyber security firm NCC Group, said retailers are becoming a particularly “attractive target” as the Black Friday sales and festive period approach. He told the Standard: “Organisations need to understand where their data is held, who can access it and whether their suppliers meet appropriate security standards.