Fashion retailer TFG London hit by cyber attack, second UK brand breach in a week

The owner of fashion brands Hobbs, Whistles and Phase Eight has confirmed a cybersecurity incident that disrupted its UK operations, marking the second retailer breach in a week and prompting fresh warnings about the sector’s vulnerability.

South African retail group The Foschini Group (TFG) said it became aware of the incident on Sunday, 11 October, affecting its UK subsidiary TFG London. The attack impacted “certain of its IT systems” specifically for the Phase Eight, Hobbs and Whistles brands, the company said. Other brands in the portfolio, including Inside Story and White Stuff, were not affected.

TFG stated there is “no reason to believe that payment information is at risk.” The incident was reported to the UK’s Information Commissioner’s Office (ICO), which said it is “assessing the information provided.” Organisations must notify the ICO of personal data breaches within 72 hours unless no risk to individuals is posed.

Operations at TFG Africa and TFG Australia were not affected, the group added.

TFG London said stores remain open but some brand website capabilities may be unavailable as the investigation continues. Customers who placed orders before Sunday were told their purchases would be processed and delivered as normal. Orders placed after Sunday may face delays, though the company said there is no need to resubmit them. Returns can be made in stores; the subsidiary is working on a solution for postal returns.

In a statement, TFG London said: “On Sunday, 11 October, TFG London identified a cybersecurity incident affecting some of our IT systems, specifically impacting our Phase Eight, Hobbs, and Whistles brands. We are actively investigating and working with external cyber security specialists. … We apologise for any disruption and will provide additional updates to our customers as appropriate.”

The incident follows an attack on fast-fashion retailer Asos a week earlier. Asos said an “unauthorised party” had accessed some personal data, including names and contact details. Asos customers received a phone alert indicating the data storage firm Snowflake had been compromised. Snowflake later said the breach was not caused by a vulnerability or flaw with its platform.

On Monday, it was reported that H&M was investigating claims it was targeted by a cybercriminal last week. The Swedish fashion giant said it was looking into a potential incident by a group called Shinyhunters, according to The Times.

The string of breaches has drawn sharp reactions from cybersecurity experts and consumer advocates.

Lisa Barber, tech editor at Which?, said: “Shoppers will be deeply concerned to learn of these latest security breaches, particularly coming so soon after the Asos hack.” She urged consumers to use strong, unique passwords and enable two-factor authentication wherever possible.

Beverley Griffiths, senior lecturer in security and resilience at Bucks New University, said: “This is the second UK retailer to be hit in a week and it’s a clear sign that major brands are firmly in the crosshairs of cyber attackers.” She added that no organisation is immune, and the real test is how quickly a business can detect, respond, and recover while keeping customers informed.

Jonathon Ellison, director for national resilience at the National Cyber Security Centre (NCSC), said in a LinkedIn post: “The real-world consequences of cyber attacks can be shocking but they should be no revelation – malicious actors can and do inflict harm on businesses and individuals every day.” He noted the NCSC is engaging with the retail sector through trusted networks to promote sharing insights and strengthening cyber resilience. “All organisations must take action to bolster their cyber defences – whether they are small start-ups or huge multinationals,” he added.

Ade Clewlow, senior adviser at cybersecurity firm NCC Group, warned that retailers are becoming a particularly “attractive target” as the Black Friday sales and festive period approach. He said organisations need to understand where data is held, who can access it, and whether suppliers meet appropriate security standards. “Without knowing how the cyber criminals will conduct an attack, it’s almost impossible to implement the most appropriate defensive measures,” he said.

TFG London first entered the UK market in 2015 with the acquisition of Phase Eight and later added Whistles, Hobbs, homeware brand Inside Story, and lifestyle brand White Stuff. Headquartered in London, the subsidiary employs more than 3,000 people and operates across the UK, Europe, America and Asia.