TFG London confirms an IT breach affecting Phase Eight, Hobbs, and Whistles systems, while stores remain open and payment data appears safe.
Key points
- TFG London detected a cyberattack on October 11 impacting Phase Eight, Hobbs, and Whistles IT systems
- Physical stores remain open, but online orders placed on or after October 11 may face delays
- The company states payment information is not at risk, though other customer data exposure is under investigation
TFG London confirmed a cybersecurity incident that disrupted IT systems supporting its Phase Eight, Hobbs, and Whistles fashion brands. The company detected the attack on October 11 and notified shareholders on October 13, while physical retail locations continued to operate normally for customers.
What happened
TFG London, the UK subsidiary of South Africa’s The Foschini Group, activated its incident response plans after discovering the breach on October 11. External cybersecurity experts are assisting in containment efforts, and the company has informed relevant UK authorities about the intrusion. Several IT systems remain unavailable, causing disruptions to online services for Phase Eight, Hobbs, and Whistles customers.
Physical stores for these brands remain open, but website functions may be limited. Orders placed on or after October 11 could experience delays, and customers are advised not to resubmit those transactions. Purchases made before that date are expected to process and deliver without issue, according to company communications.
The incident is confined to the UK business. TFG Africa and TFG Australia operate on separate systems and were not affected. Similarly, the brands Inside Story and White Stuff, which are also owned by the group, did not experience any system disruptions or data exposure from this event.
Why it matters
System unavailability does not automatically indicate data theft or ransomware encryption. Attackers may disrupt services to create chaos while quietly exfiltrating sensitive records. Separating regional operations, as TFG did with its African and Australian branches, limits blast radius during an incident. However, shared IT infrastructure within a region can allow threats to spread across multiple brands quickly.
The fix
- Monitor official brand channels for updates on order status and system recovery timelines
- Avoid resubmitting orders that were placed during the disruption window to prevent duplicate charges
- Verify any communication claiming to be from TFG London brands before clicking links or providing details
- Review bank and credit card statements for unauthorized transactions, even if payment data is reportedly safe
Why it matters
When IT systems go offline, organizations often struggle to distinguish between a denial-of-service attack and a data breach. Teams usually isolate affected networks to prevent lateral movement while forensic analysts examine logs. Customers should expect delayed responses from support channels during this period. Verifying information through official websites rather than social media rumors helps reduce confusion.
What to do and how to stay safe: TFG London
- Check your email for official notifications from TFG London regarding potential data exposure
- Enable two-factor authentication on your accounts with Phase Eight, Hobbs, and Whistles
- Watch for phishing emails that reference this incident to steal your login credentials
- Once the vendor provides an update, review which specific data types were compromised
Step-by-step guide: What is password policies and how they protect systems
General security guidance from the Crypt Weekly newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Was customer payment information stolen in the TFG London breach?
TFG London stated it has no reason to believe payment information is at risk, as a third-party provider handles transactions.
Which brands were affected by the cyberattack?
The incident impacted IT systems for Phase Eight, Hobbs, and Whistles, while Inside Story and White Stuff were unaffected.
Are TFG stores in Australia and Africa affected?
No, TFG Africa and TFG Australia operate on separate systems and were not impacted by this UK-based incident.
