TFG London Cyberattack Disrupts Hobbs, Whistles and Phase Eight

TFG London identified a cyberattack on Sunday, 11 October, and disclosed it to shareholders two days later through a stock exchange announcement. The intrusion hit IT systems supporting Phase Eight, Hobbs and Whistles, three premium fashion brands in its UK portfolio. Several of those systems remain unavailable. No shop has closed, though, and all three brands continue to trade.

The UK business sits under The Foschini Group, the Johannesburg-listed retail group that acquired Phase Eight in 2015 and Whistles the following year. Two other brands in the same stable, Inside Story and White Stuff, came through untouched. TFG Africa and TFG Australia run on entirely separate systems, and neither of them reported any operational impact at all. The wider group counted 649 retail locations and £488 million in sales as of mid-2026.

What the TFG London Cyberattack Disrupted

TFG London activated its incident response and business continuity plans as soon as it detected the cyberattack. It brought in external cybersecurity specialists and reported the matter to UK authorities. The company has not said that containment work is finished.

The announcement to shareholders stayed narrow on detail. TFG London has said nothing about how the cyberattack began, which systems the attackers moved through, or who they are. Nobody has claimed responsibility on a leak site. The words ransomware and extortion appear nowhere in the company’s public statements.

That silence fits the first week of most corporate incidents, because forensic teams rarely reach firm conclusions inside 72 hours. The practical effect for shoppers, though, sits in the gap between a disclosure and any real answer about what the attackers did. Retailers in that position face pressure to say something while they still know very little.

Stores Keep Trading While Systems Stay Down

The TFG London cyberattack never reached the shop floor. Shops across all three brands opened as normal through the week. Staff kept serving customers, and a third-party provider continued handling payment processing, which sits outside the systems the attackers reached. That separation kept tills running at the moment the back end went dark.

The online side absorbed more of the damage. Some website functions stopped working, and orders placed on or after 11 October may arrive late. Customers waiting on deliveries have no firm timeline, because TFG London has tied restoration of service to the pace of its investigation rather than to a fixed date.

The split between what failed and what survived says a great deal about how the group built its estate. Payment processing, store operations and two sister brands all carried on. The blast radius stopped where the architecture made it stop, and that outcome rarely happens by accident.

What the TFG London Cyberattack Means for Customer Data

TFG London is still investigating what personal and sensitive information the cyberattack reached. It has promised to notify affected individuals and organisations once it establishes compromise. For now, the company confirms no exposure of any kind.

An unconfirmed position offers thin comfort, and shoppers should treat it accordingly. Fashion retailers hold names, email addresses, phone numbers, delivery addresses, order histories and loyalty records. Criminals build convincing phishing from exactly that material, and a publicised incident hands them a ready-made pretext for the approach.

Shoppers at Phase Eight, Hobbs or Whistles should stay alert now rather than wait for a letter. Attackers move fast after a disclosure like this one, and they often reach customers well before the retailer manages to. A notification that lands six weeks after the TFG London cyberattack arrives well behind the damage.

A Second UK Retailer Disclosure Inside One Week

The TFG London cyberattack landed days after ASOS confirmed a data breach of its own. Attackers there reached third-party platforms the retailer uses to message customers, then pushed an extortion note through its mobile app to the user base. The two cases share a sector and a week, but nothing yet connects them technically.

British retail has taken sustained punishment since the spring of 2025, when Marks & Spencer, the Co-op and Harrods all disclosed intrusions within a fortnight of each other. Social engineering against helpdesks and employee accounts opened several of those doors. M&S lost online sales for weeks and watched shelves empty across parts of its store network.

Rumours also circulated earlier that week about an attack on H&M, claimed by an actor saying they belonged to the ShinyHunters group. The Swedish retailer said it was looking into the claims and had found no indication of compromise in its data environment. No evidence currently links that claim to the TFG London cyberattack.

What Shoppers and Retail Groups Should Take From It

Customers of the three brands should watch for emails, texts and calls referencing orders, refunds or account problems. Legitimate retailers never ask for passwords or card details through those channels. Anyone reusing a store password elsewhere should change it, and switch on multi-factor authentication wherever the option exists.

Retail groups running several brands on shared services should map which systems genuinely sit apart and which only appear to. The TFG London cyberattack spared two brands and two continents because of real separation. Test those boundaries in advance, because an incident will test them for you and will not be gentle about the result.

Trading through a cyberattack counts as a win, and TFG London managed it. The harder part starts now, because the investigation still has to establish what the attackers took, and customers deserve that answer sooner rather than later. Shoppers watching for the next notification should assume their details may be in play and act on that assumption today.