TFG London Cyber Attack Hits Hobbs, Whistles, Phase Eight; Second UK Retail Breach in a Week

South African retail group The Foschini Group (TFG) said it became aware of a “cybersecurity incident” on Sunday, affecting its UK subsidiary TFG London. The attack targeted “certain of its IT systems” and specifically impacted the Phase Eight, Hobbs, and Whistles brands. TFG said there is “no reason to believe that payment information is at risk.”

Other high street brands owned by TFG London, including Inside Story and White Stuff, are not affected. The group’s operations in TFG Africa and TFG Australia were also unaffected. TFG reported the incident to the relevant UK authorities, including the Information Commissioner’s Office (ICO), which said it was “assessing the information provided.”

The hack comes a week after fast-fashion business Asos said an “unauthorised party” had gained access to some personal data, including names and contact details. Asos customers received a phone alert claiming that data storage firm Snowflake had been compromised. Snowflake later said the breach was not caused by a vulnerability or flaw with its platform. Separately, on Monday, it was reported that Swedish fashion giant H&M was investigating claims it was targeted by a cybercriminal group called Shinyhunters, according to The Times.

TFG London said stores remain open as normal, but some website capabilities may be unavailable while the investigation continues. Customers who placed orders with Phase Eight, Hobbs, or Whistles before Sunday were told their purchases would be processed and delivered as normal. Orders placed after Sunday may face delays, but TFG said there is no need to resubmit anything. Returns can be made in stores, and the company is working on a solution for postal returns.

In a statement, TFG London said: “On Sunday, 11 October, TFG London identified a cybersecurity incident affecting some of our IT systems, specifically impacting our Phase Eight, Hobbs, and Whistles brands. We are actively investigating and working with external cyber security specialists. … We apologise for any disruption and will provide additional updates to our customers as appropriate.”

TFG London first entered the UK market in 2015 after buying Phase Eight, and has since added womenswear brands Whistles and Hobbs, homeware brand Inside Story, and lifestyle brand White Stuff. The subsidiary is headquartered in London, employs more than 3,000 people, and operates across the UK, Europe, America, and Asia.

The back-to-back breaches have heightened concerns about customer trust. Lisa Barber, tech editor at consumer group Which?, said: “Shoppers will be deeply concerned to learn of these latest security breaches, particularly coming so soon after the Asos hack.” She urged consumers to use strong, unique passwords and enable two-factor authentication.

Beverley Griffiths, senior lecturer in security and resilience at Bucks New University, said: “This is the second UK retailer to be hit in a week and it’s a clear sign that major brands are firmly in the crosshairs of cyber attackers. No organisation is immune, so the real test of resilience is how quickly a business can detect an incident, respond and recover while keeping its customers informed.” She advised customers to remain vigilant and wary of unexpected messages.

Jonathon Ellison, director for national resilience at the National Cyber Security Centre (NCSC), said in a LinkedIn post: “The real-world consequences of cyber attacks can be shocking but they should be no revelation – malicious actors can and do inflict harm on businesses and individuals every day.” He added that the NCSC is engaging with the retail sector to promote sharing insights and strengthening cyber resilience, and urged all organisations to bolster their defences.

Ade Clewlow, senior adviser at cyber security firm NCC Group, warned that retailers are becoming a particularly “attractive target” as the Black Friday sales and festive period approach. He said: “Organisations need to understand where their data is held, who can access it and whether their suppliers meet appropriate security standards.