TFG London cyberattack hits Hobbs and Whistles

The Foschini Group disclosed on Tuesday that the TFG London cyberattack knocked out IT systems at three of its UK fashion brands: Phase Eight, Hobbs and Whistles. The South African retail giant detected the intrusion on Sunday, October 11, and told investors two days later that physical stores remain open while several systems stay offline. The disclosure lands days after ASOS confirmed its own breach, putting TFG London on a growing list of British retailers hit by hackers in the past year.

According to the investor notice, reported by Moneyweb and TechCentral, the company activated its incident response and business continuity plans, brought in external cybersecurity specialists, and reported the incident to the relevant UK authorities. Two other brands in the same UK business, Inside Story and White Stuff, were not affected, and TFG Africa and TFG Australia run on separate systems that were untouched. BleepingComputer reports that no threat actor has publicly claimed responsibility for the attack, and that the company has not said what kind of intrusion took place or how the attackers got in. The JSE-listed retailer made the disclosure through a voluntary market notice in South Africa before UK outlets picked up the story.

What this means for shoppers

The question most shoppers are asking is whether personal data was exposed, and the company says it does not yet know. In its statement, TFG London said the investigation covers whether personal or sensitive information was compromised and that it will notify affected people if the probe confirms exposure. BleepingComputer advises customers of the three brands to stay alert for phishing attempts in the meantime, since breached retailers are often followed by scam emails trading on the incident. For Hobbs shoppers, the Manchester city centre store is trading as normal, the company told the Manchester Evening News.

Disruption is the part shoppers will feel first. TFG London says stores remain open, but orders placed after the Sunday intrusion may be delayed, while earlier orders are being processed as normal, according to UK press reports. Postal returns are unavailable for now, though returns can be made in stores, and the retailer has promised to keep customers informed while it builds a fix. The company told Hobbs customers by email that it is working to get every system back online as quickly and safely as it can, and that there is no need to resubmit orders already placed.

Fashion retailers keep getting hit

The TFG London cyberattack is the second breach at a UK fashion retailer disclosed in a week. Days earlier, ASOS confirmed that attackers used social engineering to steal an employee's login credentials and access customer data, including names, contact details and account information, as BleepingComputer reported. In 2025, hackers struck Marks & Spencer, the Co-op and Harrods, prompting the British government to warn companies that cybersecurity must be an absolute priority, according to TechCentral. The Register reported that several TFG systems were still offline two days after detection.

The three brands caught in the middle sit a step above the high street. Phase Eight, Hobbs and Whistles sell mid-to-premium womenswear through standalone stores, department-store concessions and e-commerce, and pieces from Hobbs and Whistles have been photographed on the Princess of Wales, a detail Retail Gazette flagged in its coverage. TFG London operates five fashion and homeware brands across 649 retail locations worldwide, after buying White Stuff in October 2024. In the year to March 31, its retail turnover rose 29.4% to £488 million, though it recorded a £21 million operating loss, partly tied to an impairment at Phase Eight, according to Drapers reporting cited by TechCentral.

For now, investigators have not confirmed any customer data exposure, and TFG said it will issue a further announcement if there are material developments. Help Net Security notes the TFG London cyberattack follows a string of retail breaches that has made UK fashion a regular target for attackers. The incident is a reminder that the brands holding card details and home addresses are often the same ones struggling to keep their own systems online. Read the full technical coverage of the TFG London cyberattack at BleepingComputer.