TFG London cyber incident hits Hobbs, Phase Eight and Whistles

TFG London says an 11 October 2026 attack disrupted Hobbs, Phase Eight and Whistles; data exposure remains unconfirmed.

The Foschini Group said its UK fashion business, TFG London, detected a cybersecurity incident on Sunday, 11 October 2026, affecting IT systems used by Hobbs, Phase Eight and Whistles. The Register reported on 13 October that several systems and some website functions remained offline, orders placed from that Sunday may be delayed and stores stayed open; it also said TFG has not confirmed personal-data theft or ransomware use, that a third-party processor handles payments and those details are not believed at risk, and that the UK ICO received a breach report. Help Net Security reported on 14 October that Inside Story, White Stuff, TFG Africa and TFG Australia were spared because they use separate systems, that personal-data exposure is still under investigation, and that people will be notified if it is confirmed. The sources differ in tone: The Register describes the brands as compromised, while Help Net Security says they were targeted and that an attack was detected. Both note a separate ASOS incident—The Register specifies impersonation of a trusted contact, stolen employee credentials and access to customer contact data—and they disagree on H&M, with The Register saying claims are still being examined and Help Net Security’s summary saying no compromise was found while its own points say checking continues.

• TFG London, the UK arm of South Africa’s The Foschini Group, detected a cyber incident on Sunday, 11 October 2026.
• Systems for Hobbs, Phase Eight and Whistles were affected; Inside Story, White Stuff, TFG Africa and TFG Australia were not.
• Stores stayed open, while several IT systems and some website functions remained offline and orders placed from 11 October may be delayed.
• Personal-data exposure and ransomware use are unconfirmed; TFG says affected people will be notified if exposure is found.
• A third party handles payments, which are not believed at risk, and the UK ICO has received a breach report it is assessing.
• Separately, ASOS said an attacker impersonated a trusted contact, stole employee credentials and reached customer contact data.
• Sources disagree on H&M: The Register says it is examining unconfirmed ShinyHunters claims, while Help Net Security’s summary says no compromise was found even as its points say checks continue.