The owner of three well-known British fashion brands is scrambling to contain a cybersecurity incident that has knocked out parts of its online operations just as the retail industry heads into its busiest season. The Foschini Group (TFG), the South African retail conglomerate that owns Hobbs, Whistles, and Phase Eight through its UK arm TFG London, confirmed on Tuesday, October 13, 2026, that it identified the breach two days earlier and is now working with outside specialists to figure out what happened.
The disclosure adds TFG London to a growing list of UK and European retailers hit by cyberattacks in the past 18 months, a run that includes Marks & Spencer, the Co-op, and Harrods. For a sector still recovering from those earlier incidents, the timing could hardly be worse: Hobbs, Whistles, and Phase Eight are all mid-to-premium fashion labels that depend heavily on online sales and loyalty programs, and any prolonged disruption to e-commerce systems during the run-up to the holiday shopping season carries real financial risk.
Don't miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
TFG London Confirms Cyberattack at Hobbs, Whistles, and Phase Eight
According to the company’s own account, TFG London identified the incident on Sunday, October 11, and said it affected “certain of its IT systems,” specifically those tied to the Phase Eight, Hobbs, and Whistles brands. The group’s statement did not name an attacker, a ransomware gang, or a method of entry. “On Sunday, 11 October, TFG London identified a cybersecurity incident affecting some of our IT systems, specifically impacting our Phase Eight, Hobbs, and Whistles brands,” the company said in its public statement.
TFG London told BBC News that it was “actively investigating and working with external cyber security specialists,” language that mirrors the standard early-stage incident-response playbook used across the retail sector in recent breaches. The company said its physical stores stayed open across the three affected brands on October 13, 2026 and remained open and trading throughout, while acknowledging that “some online functions might be unavailable” to shoppers trying to browse or place orders on the affected brands’ websites.
Crucially, TFG said there was “no reason to believe that payment information is at risk,” pointing to the fact that card payments for its UK brands are processed through an external payment provider rather than stored on the company’s own systems. That distinction matters: it is the same defense Marks & Spencer and other recently breached UK retailers have leaned on, separating the question of operational disruption from the more serious question of whether customer payment data was actually exposed.
Timeline: How the TFG London Cyberattack Unfolded
The public timeline so far is short but telling. TFG detected the problem on a Sunday, which is often when retailers’ overnight batch jobs, backups, or automated monitoring first flag anomalous activity, and took two full days before making a public statement, a gap the company used to notify shareholders in South Africa through a formal market disclosure before UK press coverage picked up the story.
| Date | Event |
|---|---|
| Sunday, October 11, 2026 | TFG London identifies a cybersecurity incident affecting IT systems linked to Phase Eight, Hobbs, and Whistles |
| October 11, 2026 | TFG activates its incident response and business continuity plans; external cybersecurity specialists engaged |
| Tuesday, October 13, 2026 | The Foschini Group discloses the incident to shareholders via a market notice in South Africa |
| October 13, 2026 | UK media, including the BBC, report that TFG London is investigating the incident and that online functions may be unavailable |
| October 13, 2026 | The Register reports several IT systems remain offline two days after detection, with customers facing possible order delays |
| October 14, 2026 | Investigation into whether personal customer data was accessed remains ongoing; no breach of customer data confirmed |
Two days between detection and disclosure is roughly in line with how other recent UK retail breaches have played out, though it is faster than some. Notably, Japanese test-equipment maker Advantest took 233 days to disclose a ransomware breach earlier this year, an outlier at the opposite extreme that regulators have cited as an example of unacceptably slow reporting.
What Customer Data Could Be at Risk
This is the question every Hobbs, Whistles, and Phase Eight customer actually cares about, and it is also the one TFG has been most careful not to answer prematurely. The company said on October 13, 2026 that it is investigating whether sensitive or personal customer information was affected by the incident, but it has not confirmed that any specific data category, such as names, email addresses, delivery addresses, order histories, or account passwords, was accessed or removed from its systems.
TFG London said customers whose personal information is found to have been affected will be contacted directly once the investigation concludes. That is a fairly standard commitment under UK data protection law, which requires organizations to notify affected individuals “without undue delay” once a breach involving personal data is confirmed, not merely suspected. The company added in a statement reported by outlets covering the story: “As soon as we identified the incident, we activated our business continuity plan, engaged external cyber security experts and informed relevant authorities.”
TFG also told customers, according to reporting on the incident, “Our investigation is ongoing and we are working hard to get all our systems back up and running as quickly and safely as we can.” On the narrower question of financial exposure, the company reiterated: “There is currently no reason to believe that payment information is at risk.” Both statements leave open the possibility that the broader forensic review, which typically takes weeks rather than days, could still surface evidence of data exfiltration that was not apparent in the first 48 to 72 hours.
A Pattern: UK Retail’s Brutal Cyberattack Year
What makes the TFG London incident newsworthy beyond its own facts is the company it now keeps. UK and European retail has endured an unusually bad run of cyberattacks since early 2025, and this latest incident lands in the same week that H&M was reportedly probing a separate hack claim, according to the BBC’s reporting. The Register went so far as to describe TFG as joining an “autumn pwned collection” of fashion retailers, a pointed way of noting that this is now a pattern rather than an isolated event.
Marks & Spencer and the Co-op both suffered high-profile cyberattacks in 2025 that disrupted operations for weeks and drew sustained media and regulatory attention. Harrods was also hit in a separate incident around the same period. Coverage of the TFG breach has explicitly drawn comparisons to those cases, even though, unlike the M&S and Co-op incidents, there is no public confirmation yet of a ransomware group claiming responsibility, a leak-site posting, or a ransom demand tied to TFG London.
The pattern extends beyond the UK. French supermarket chain CoopÃĐrative U disclosed a cyberattack affecting roughly 80 stores, and reporting on the TFG incident notes that French retailer IntermarchÃĐ has also been targeted by cybercriminals recently, according to InternetRetailing, which described the threat to the retail sector as “rocketing.” Retail Gazette similarly framed the TFG incident as part of a wave of fresh attacks hitting the sector.
| Retailer | Brands/Scope Affected | Disclosure Period | Customer Data Confirmed Stolen |
|---|---|---|---|
| TFG London (The Foschini Group) | Hobbs, Whistles, Phase Eight | October 2026 | Not confirmed, under investigation |
| Marks & Spencer | Online ordering and store operations | 2025 | Confirmed in prior public reporting |
| Co-op | Group-wide IT systems | 2025 | Confirmed in prior public reporting |
| Harrods | Department store operations | 2025 | Limited exposure reported |
| CoopÃĐrative U (France) | Approximately 80 stores | 2026 | Under investigation |
| H&M | Separate hack claim, per BBC | October 2026 | Not confirmed |
The common thread across nearly every entry in that table is a multi-day or multi-week gap between detection and full public clarity on what data, if any, was actually taken. That lag is less a sign of corporate stonewalling than a reflection of how forensic investigations actually work: identifying that systems were accessed is often immediate, while determining what an attacker actually copied, exfiltrated, or viewed can take investigators weeks of log analysis.
Why Fashion and Retail Brands Keep Getting Hit
Retail has become one of the more attractive targets for financially motivated attackers for reasons that go beyond simple opportunism. Fashion retailers in particular tend to run a patchwork of e-commerce platforms, loyalty programs, warehouse management systems, and third-party logistics integrations, each representing a potential point of entry. TFG London’s statement that its separate White Stuff and Inside Story brands were unaffected, while Phase Eight, Hobbs, and Whistles were hit, hints at exactly this kind of fragmented IT architecture, where different brands under the same parent company run on different, only partially connected systems.
That fragmentation can actually work in a retailer’s favor during an incident, since it limits blast radius. TFG’s ability to keep White Stuff, Inside Story, and its African and Australian operations running normally while isolating the three affected UK brands suggests the company’s network segmentation held up reasonably well, even if the IT systems for Phase Eight, Hobbs, and Whistles took a direct hit.
Retailers are also attractive targets simply because of the volume and richness of the personal data they hold: names, addresses, purchase histories, loyalty program details, and, in many cases, stored payment tokens, even when full card numbers are not retained. That data has resale value on criminal marketplaces regardless of whether an attacker’s primary goal was a ransom payment or data theft for its own sake.
The Unanswered Question: How Did Attackers Get In?
TFG London has not disclosed how the attackers gained access to its systems, and no credible ransomware group has publicly claimed responsibility for the intrusion as of October 14. That silence is itself notable. In several of the highest-profile UK retail breaches of the past two years, attackers associated with loosely affiliated criminal collectives have used social engineering and help-desk impersonation to trick IT support staff into resetting credentials, a technique that has proven effective against large, multi-brand retail groups with centralized IT support functions.
The Register reported that several of TFG London’s IT systems remained unavailable on October 13, 2026, two days after detection, which is consistent with a company deliberately taking systems offline as a precaution rather than attackers having caused an outright outage. Taking systems offline voluntarily, often called an “isolate and contain” response, is standard practice once a breach is suspected, since it prevents malware or an intruder from moving laterally into additional systems while investigators work.
BleepingComputer noted that the company disclosed the incident while several IT systems remained unavailable, even as physical stores stayed open for customers, reinforcing that this looks more like a contained IT disruption than a full operational collapse.
Market and Business Impact for The Foschini Group
The Foschini Group is listed on the Johannesburg Stock Exchange, and the company chose to disclose the incident formally to shareholders through a South African market notice rather than through a UK press release alone, a procedural step that reflects its obligations as a publicly traded company. No quantified share-price movement, revenue impact, or cost estimate tied specifically to the incident has been publicly confirmed as of October 14.
That lack of a confirmed financial figure does not mean the exposure is small. Comparable UK retail breaches in 2025 carried direct costs running into the tens of millions of pounds once lost sales, incident response fees, legal costs, and regulatory engagement were tallied, though TFG has not released any comparable number for this incident. For a premium fashion group heading into the critical pre-Christmas trading period, even a short-term e-commerce outage across three brands can translate into meaningful lost online revenue, separate from any longer-term reputational cost or potential regulatory penalty.
The company’s decision to keep physical stores open throughout the incident was likely a deliberate move to protect in-person revenue, which for established fashion brands like Hobbs and Phase Eight still represents a significant share of total sales, even as online channels have grown.
Regulators and the Information Commissioner’s Office
TFG said it had informed “relevant authorities” of the incident, language that in a UK context typically refers to notification obligations under the UK General Data Protection Regulation and the Data Protection Act 2018, which require data controllers to report qualifying personal data breaches to the Information Commissioner’s Office within 72 hours of becoming aware of them if the breach is likely to result in a risk to individuals’ rights and freedoms.
As of October 14, there is no public statement from the ICO itself specifically addressing the TFG London incident. That is not unusual at this early stage; the ICO typically does not comment publicly on individual breach notifications while an investigation is ongoing unless it later issues formal findings or a penalty notice, something that can take many months after an incident is first reported.
How TFG’s Response Compares to Other Retailers
Measured against recent peers, TFG London’s public communication strategy has followed a fairly conventional script: acknowledge the incident quickly, name the affected brands specifically, downplay payment-data risk while the investigation continues, and promise direct notification to any customers later confirmed to be affected. That mirrors how Marks & Spencer and the Co-op initially communicated during their 2025 incidents, before both situations evolved into longer, more damaging sagas as additional details emerged over subsequent weeks.
One meaningful difference so far is speed of disclosure. TFG went public within roughly 48 hours of detecting the incident, a faster turnaround than some comparable cases. Retail Gazette framed the disclosure as part of a broader pattern of “fresh attacks” hitting the sector, suggesting that retailers, chastened by the reputational damage other companies suffered from slow or incomplete disclosures in 2025, may now be erring toward faster public acknowledgment even before all the facts are known.
Whether that speed holds up as a genuine improvement, or simply reflects a company getting ahead of a disclosure that shareholders would have demanded anyway given its public listing, will become clearer as the investigation progresses and more concrete findings are published.
What Happens Next: Five Predictions
- A fuller data-exposure picture emerges within two to four weeks. Based on the pace of comparable UK retail investigations, TFG is likely to issue a follow-up statement once forensic specialists determine whether personal data was actually copied or merely accessed.
- Affected IT systems are fully restored before the holiday shopping peak. Given that TFG kept physical stores open and prioritized incident containment over a full shutdown, online ordering functions for Hobbs, Whistles, and Phase Eight are likely to be restored ahead of the critical November-December trading window.
- Scrutiny of TFG’s broader UK IT estate increases. Expect questions about whether the same vulnerability or access method that hit Phase Eight, Hobbs, and Whistles could also affect other brands under the TFG umbrella, even those reported as currently unaffected.
- No ransomware group claim materializes in the near term, or one does and changes the story entirely. The absence of a leak-site posting or ransom claim so far suggests either a contained intrusion without data theft, or a group that has not yet gone public, both of which remain live possibilities.
- Other UK and European fashion retailers face renewed pressure to disclose their own security postures. With H&M reportedly probing a separate hack claim in the same news cycle, expect increased investor and press questions directed at other large fashion groups about their own incident-response readiness.
What Hobbs, Whistles, and Phase Eight Customers Should Do Now
Even though TFG has said there is no current reason to believe payment data is at risk, security practitioners generally recommend that customers of any affected retailer take a few precautionary steps while an investigation is ongoing. Changing account passwords for the affected brands’ websites is a reasonable first step, particularly for anyone who reuses the same password across multiple online retailers. Customers should also watch for phishing attempts that reference the breach itself, since attackers frequently use news of a real incident to craft convincing follow-up scam emails impersonating the affected company.
Keeping an eye on bank and card statements for unfamiliar transactions remains sensible general practice, even with TFG’s assurance that payment processing runs through a third-party provider separate from the compromised systems. Customers who receive a direct notification from TFG London in the coming weeks confirming that their personal data was affected should follow whatever specific guidance the company provides at that time, which will likely include details on what categories of information were involved.
The Bigger Picture for UK Retail Cybersecurity
Whatever the eventual scope of the TFG London incident turns out to be, its timing underscores a broader structural problem facing UK retail: a sector built on complex, multi-brand corporate structures, legacy e-commerce platforms, and third-party integrations, operating against a backdrop of financially motivated criminal groups that have found repeated success against exactly this kind of target over the past 18 months. The Marks & Spencer and Co-op incidents in 2025 were supposed to serve as wake-up calls for the sector. Whether this latest incident at Hobbs, Whistles, and Phase Eight represents a genuine escalation in defenses, or simply the next entry in an ongoing pattern, is likely to become clearer only once TFG completes its investigation and discloses what, if anything, attackers actually took.
Frequently Asked Questions
What brands were affected by the TFG London cyberattack?
Phase Eight, Hobbs, and Whistles, the three UK fashion brands owned by TFG London, the UK arm of South Africa’s The Foschini Group. White Stuff and Inside Story, also owned by TFG, were not reported as affected.
When did TFG London first detect the incident?
TFG London said it identified the cybersecurity incident on Sunday, October 11, 2026, and disclosed it publicly two days later, on Tuesday, October 13, 2026.
Is customer payment information at risk?
TFG London has said there is “no reason to believe that payment information is at risk,” noting that card payments for its UK brands are processed by an external payment provider. This assessment could be updated as the investigation continues.
Has a ransomware group claimed responsibility?
No. As of October 14, 2026, no ransomware group or criminal collective had publicly claimed responsibility for the TFG London incident, and TFG has not disclosed an attack vector.
Are Hobbs, Whistles, and Phase Eight stores still open?
Yes. TFG London said its physical stores remained open and trading throughout the incident, even as some online functions were disrupted.
How does this compare to the Marks & Spencer and Co-op cyberattacks?
Unlike the 2025 Marks & Spencer and Co-op incidents, which involved confirmed customer data exposure and sustained operational disruption, the TFG London incident has so far been described as more limited, with no confirmed data breach and physical stores unaffected. The investigation is still ongoing, however, and the picture could change.
Will affected customers be notified directly?
TFG London has said that any customers whose personal information is confirmed to have been affected will be contacted directly once the investigation is complete.
What should customers do in the meantime?
Security practitioners generally recommend changing account passwords, watching for phishing emails referencing the breach, and monitoring bank statements for unusual activity, even though no payment-data compromise has been confirmed.
