TFG London Cyberattack Disrupts IT Systems for Hobbs, Whistles, and Phase Eight
The Foschini Group’s UK unit detected a breach on October 11 that has left several online services offline while physical stores remain open.
Key points
- TFG London detected a cyberattack on October 11, 2026, impacting IT systems for Phase Eight, Hobbs, and Whistles.
- Physical retail locations remain open, but online services are offline and customer orders placed on or after October 11 may be delayed.
- The company has not confirmed any customer data exposure, though it is investigating whether personal information was compromised.
TFG London, the UK subsidiary of South Africa’s The Foschini Group, detected a cybersecurity incident on October 11, 2026, that has disrupted IT systems supporting its premium fashion brands. The company disclosed the breach to shareholders on October 13, confirming that the attack impacted infrastructure used by Phase Eight, Hobbs, and Whistles, according to Cyber Security News.
Several critical IT systems remain unavailable following the detection of the incident, although physical stores across the UK continue to operate normally for customers. TFG London activated its incident response and business continuity plans immediately upon discovery, bringing in external cybersecurity experts to help contain the threat. The company has informed relevant UK authorities about the breach as part of its containment efforts.
Scope and Impact
The disruption is currently limited to the group’s UK business operations, with no impact on its brands Inside Story and White Stuff. Additionally, TFG Africa and TFG Australia remain unaffected because they operate on separate, isolated systems, according to the company’s shareholder announcement. This separation prevents the incident from escalating into a global operational crisis for the retailer.
Customers are experiencing significant friction with online services, as some website functions are unavailable and orders placed on or after October 11 may face delays. TFG London has advised customers not to resubmit these delayed orders, noting that purchases made before Sunday are expected to be processed and delivered on schedule. The company stated it has no reason to believe payment information is at risk, as a third-party provider handles all payment processing.
Investigation Status
TFG London is actively investigating whether any customer information has been compromised during the attack. The company has not ruled out the exposure of other customer data and has committed to directly notifying individuals or organizations if their data was affected. As of mid-2026, the group operated 649 retail locations globally and reported annual sales of £488 million ($646M).
No threat actor has publicly claimed responsibility for the TFG London breach, and the company has not disclosed the attackers’ identity, their entry point, or whether ransomware was involved. TFG has also not provided a deadline for full system recovery, leaving the duration of the disruption uncertain.
What should you do?
Customers of Phase Eight, Hobbs, and Whistles should remain alert for potential phishing and social engineering attacks, as attackers often exploit such incidents to target confused users. Individuals who placed orders on or after October 11 should monitor their email for updates from TFG London and avoid resubmitting orders to prevent duplicates.
Background: Social engineering
Look for urgency, secrecy, and deviation from standard channels. Verify identity through a separate, known communication path before acting. Isolate suspicious interactions immediately to prevent lateral movement within your network environment.
Read the full guide: Social Engineering Warning Signs and How to Respond
What to do and how to stay safe: TFG London
- Monitor email and SMS for official communications from TFG London regarding order status and data exposure.
- Be vigilant against phishing attempts that reference this incident, especially those requesting login credentials or payment details.
- Check bank and credit card statements for unauthorized transactions, even though the vendor states payment data is likely safe.
- Change passwords for any accounts shared across these brands if you suspect your credentials may have been exposed in prior breaches.
Step-by-step guide: Mobile Device Security: How to Protect Data Beyond Passwords
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which brands are affected by the TFG London cyberattack?
The incident impacts IT systems used by Phase Eight, Hobbs, and Whistles, while Inside Story and White Stuff remain unaffected.
Has customer data been stolen in the TFG London breach?
TFG London has not confirmed any customer data exposure yet, but it is investigating whether personal information was compromised.
Are physical stores open during the TFG London cyberattack?
Yes, physical stores for the affected brands remain open for customers, although online services and order processing are disrupted.
