TFG London Cyber Incident Hits 3 Brands; Payment Data Likely Secure, Physical Stores Open
A cybersecurity incident detected on October 11 has left several IT systems unavailable for three UK fashion brands, though physical stores remain open.
Key points
- TFG London detected the incident on October 11, 2026, and disclosed it to shareholders on October 13.
- Phase Eight, Hobbs, and Whistles systems are disrupted; Inside Story, White Stuff, and overseas operations are unaffected.
- The company is investigating potential data compromise but states payment information is likely secure.
TFG London detected a cybersecurity incident on October 11 that disrupted IT systems supporting its Phase Eight, Hobbs, and Whistles brands, according to reports from BleepingComputer and Cyber Security News. The UK subsidiary of South Africa’s The Foschini Group activated its incident response plans immediately, bringing in external experts to contain the threat while physical retail locations remained open for customers.
The risk
Several IT systems for the three affected brands remain unavailable, causing delays for online orders placed on or after October 11, according to Cyber Security News. Customers have been advised not to resubmit delayed orders, as purchases made before that date are expected to process normally. TFG London has not confirmed whether customer data was exfiltrated, but it is investigating the scope of the breach and will notify affected individuals if personal information was compromised.
Who is exposed
The disruption is limited to the UK operations of Phase Eight, Hobbs, and Whistles. According to the company’s shareholder announcement, the Inside Story and White Stuff brands were not affected. Additionally, TFG Africa and TFG Australia remain operational because they function on separate systems, isolating the incident from the group’s global footprint. No threat actor has publicly claimed responsibility for the TFG London breach.
Cost and compliance
TFG London has not disclosed the attackers’ identity, their entry method, or whether ransomware was involved in the disruption. The company has not provided a timeline for full system recovery. While adjusted operating profit fell significantly in June due to various pressures, including an earlier cyber incident affecting a partner, this financial figure should not be presented as the cost of the October attack, according to Cyber Security News.
What should you do?
Customers of the affected brands should monitor their email for official notifications regarding potential data exposure. Users should remain vigilant against phishing attempts that may reference this incident, as is common after publicized breaches. Avoid resubmitting delayed online orders to prevent further system strain or duplicate charges.
The background in plain language
When retailers suffer IT disruptions, teams usually isolate affected systems to prevent spread. Customers often face delays in order processing or account access. Organizations typically engage external specialists to contain threats and investigate data exposure. Managers should verify which services are down and communicate clearly with users about expected recovery timelines and potential risks to personal information.
Background: Phishing
Look for mismatched URLs, generic greetings, and urgent threats. Verify links by hovering, not clicking. Check the sender’s actual email address, not the display name. When in doubt, contact the sender through a separate, trusted channel. Do not download attachments from unknown sources.
Read the full guide: Phishing Warning Signs: Spotting Attacks Before You Click
What to do and how to stay safe: TFG London
- Monitor official communications from Phase Eight, Hobbs, and Whistles for updates on data exposure.
- Review recent emails for suspicious links or requests for login credentials related to these brands.
- Do not resubmit online orders placed on or after October 11 to avoid duplicate transactions.
- Enable multi-factor authentication on any accounts associated with these retailers once systems are restored.
Step-by-step guide: Mobile Security Architecture: 8 Practices for Device Integrity
General security guidance from the Vector Tribune newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which TFG London brands were affected by the cyberattack?
Phase Eight, Hobbs, and Whistles were affected, while Inside Story and White Stuff were not.
Is customer payment information at risk?
TFG London states it has no reason to believe payment information is at risk, as a third party handles processing.
Were overseas operations impacted?
No, TFG Africa and TFG Australia operate on separate systems and were unaffected.
