Owner of fashion brands Hobbs and Whistles joins autumn pwned collection

Several IT systems remain offline and orders face delays as TFG London becomes latest retailer to suffer cyberattack

The owner of Hobbs, Phase Eight, and Whistles is the latest fashion retailer to suffer a cyberattack, leaving several IT systems offline and customers facing order delays.

South African retail giant The Foschini Group (TFG) confirmed on Tuesday that its UK business, TFG London, discovered a cybersecurity incident on October 11 that affected all three brands. Two days later, several systems remain unavailable, and the company is still trying to establish whether any personal or sensitive information has been compromised.

The incident hasn’t forced stores to close, but TFG said some website functions may be unavailable. Customers have also been warned that orders placed on or after Sunday could be delayed, according to an email seen by The Telegraph. 

"Stores are open as normal but some of our brand's website capabilities may not be available as the investigation continues," the company said. "We apologize for any disruption and will provide additional updates to our customers as appropriate."

TFG said it immediately activated its incident response and business continuity plans, brought in external cybersecurity specialists, and notified the relevant UK authorities.

A spokesperson at the ICO told The Register: “We can confirm we have received a breach report from TFG Brands (London) Limited and we are assessing the information provided.”

There is at least some good news for shoppers worried about their payment details. In an email to customers, TFG London said a third-party provider handles payment processing and that, based on its investigation so far, it has no reason to believe payment information is at risk.

Whether other customer data has escaped into the wild is another matter. TFG said it is still investigating that possibility and will notify affected individuals or organizations if it finds evidence of a compromise.

The company has yet to disclose how attackers gained access, whether ransomware was involved, or when it expects to have its systems fully restored, and did not respond to The Register’s questions. 

The disruption appears to be confined to the three fashion brands. TFG said its White Stuff and Inside Story businesses are unaffected, as are its operations in Africa and Australia, which run on separate IT systems.

The attack comes during a particularly miserable spell for fashion retailers, which seem to be attracting cybercriminals almost as enthusiastically as shoppers chasing a sale.

Last week, ASOS customers received an unexpected notification informing them that the online fashion retailer had been hacked. ASOS subsequently confirmed that an attacker had gained access to an employee account by impersonating a trusted contact and obtaining login credentials. Armed with those credentials, the attacker got into third-party platforms holding customer names and contact details. 

Meanwhile, H&M is reportedly investigating claims that it was targeted by the notorious ShinyHunters cybercrime group. According to The Times, the Swedish fashion giant is examining allegations involving a limited amount of company data, although it stressed that it had found no indication its systems had been compromised.

No evidence currently links the incidents at TFG London, ASOS, and H&M, and the latter has not confirmed a breach.

Still, with three major fashion businesses linked with cyber trouble in little more than a week, October's hottest retail trend appears to be incident response.®