TFG London Cyberattack Disrupts IT Systems for Phase Eight, Hobbs, Whistles

Key Takeaways

• A cyberattack has severely impacted the IT infrastructure of TFG London, affecting its fashion brands Phase Eight, Hobbs, and Whistles.
• The incident, detected on October 11, 2026, has led to system disruptions, although physical stores remain operational.
• While payment information appears secure due to a third-party processor, an investigation is underway to determine if other sensitive customer data was compromised.
• TFG Africa and TFG Australia are unaffected due to separate system architectures.

TFG London Grapples with Cyberattack Disrupting Key UK Brands

TFG London has confirmed that a cyberattack has incapacitated critical IT systems supporting its prominent UK fashion labels: Phase Eight, Hobbs, and Whistles. South Africa’s The Foschini Group, the parent company, first identified the security breach on October 11, 2026, and subsequently informed its shareholders two days later, on October 13. While the attack has rendered several internal systems inoperable, the company’s retail stores continue to conduct business.

Scope of the Disruption

According to the company’s shareholder announcement, the incident’s impact is localized to TFG London. Other brands within the group, such as Inside Story and White Stuff, were not affected. Crucially, TFG Africa and TFG Australia remain entirely operational, as their IT infrastructures are distinct and separate from the compromised UK systems. This compartmentalization has prevented a global disruption across the group’s extensive operations.

Following the discovery of the attack, TFG immediately initiated its incident response protocols and business continuity plans. The company has engaged external cybersecurity experts to assist in containing the breach and is collaborating with relevant UK authorities as part of its ongoing investigation.

The full extent of data compromise remains under active investigation. TFG is working to ascertain whether any personal or other sensitive information has been exfiltrated. While physical stores continue to trade, customers may encounter issues with some website functionalities, and orders placed on or after October 11 could experience delays. The company has advised customers against re-submitting these orders.

Orders placed before the incident’s detection on Sunday are expected to be processed and delivered without interruption. In its communications to customers, TFG London emphasized that a third-party provider manages its payment processing. Based on preliminary findings, the company has “no reason to believe that payment information is at risk.” However, the possibility of other customer information being exposed has not been ruled out. TFG has committed to directly notifying any individuals whose data is confirmed to have been affected.

As of now, TFG has not publicly identified the perpetrators, detailed the initial point of compromise, or confirmed whether ransomware was involved. The company has also refrained from providing an estimated timeline for the complete restoration of all affected systems. These undisclosed specifics are critical for understanding the nature of the attack, as system unavailability alone does not clarify whether the incident involved data encryption, theft, or other forms of malicious activity.

The architectural separation of systems for TFG’s African and Australian operations provides a clear boundary for the reported impact. However, the company has not yet released sufficient technical details to specify which UK applications were compromised or precisely how access across the three affected brands was disrupted.

This incident is not the first cybersecurity challenge for TFG. The company’s June financial results mentioned an earlier cyber incident impacting a significant online concession partner. This previous disruption was cited as one of several factors contributing to pressure on its UK portfolio. Excluding brand impairment and acquisition costs, adjusted operating profit saw a 65.4% decline, though this figure predates and should not be attributed to the current October attack.

The broader retail sector has recently seen other high-profile cyber incidents, including a Marks & Spencer attack that impacted payment and collection services, and a Harrods supplier data breach exposing customer records. While these incidents are not linked to TFG, they underscore the escalating cybersecurity risks faced by retailers. For TFG London, the immediate priorities remain uncovering how unauthorized access was gained, confirming whether data was stolen, and establishing a secure timeline for service restoration.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.