TFG London Confirms Cyberattack Affecting Hobbs, Whistles, and Phase Eight

TFG London has confirmed a cybersecurity incident affecting the IT systems that support its brands Hobbs, Whistles, and Phase Eight. Several of these systems remain unavailable.

The parent company, The Foschini Group, disclosed the incident in a stock exchange announcement on October 13, 2026, after its UK business identified the security disruption on October 11.

The announcement indicates an operational impact across the three fashion brands. However, it does not specify the attack method, initial access vector, or responsible threat actor.

TFG referred to the event as a cybersecurity incident without confirming details regarding potential ransomware involvement, malware deployment, data theft, or extortion demands, leaving these possibilities unverified.

After detecting the incident, the group immediately activated its incident response and business continuity plans. TFG London also engaged external cybersecurity specialists to contain the situation and has reported it to the relevant UK authorities.

However, the announcement does not name the authorities or provide details on the specialists, containment measures, or forensic investigations.

Despite the disruption, TFG London said its stores remain open and continue trading. However, the ongoing unavailability of several IT systems suggests that operational continuity does not mean full restoration of technological services.

The company did not specify which applications were affected, whether payment processing was disrupted, or whether online services were interrupted.

The affected scope is limited to the brands mentioned in the announcement; TFG says Inside Story and White Stuff are unaffected. Its operations in Africa and Australia are also unaffected, as they run on separate systems. This distinction is significant when assessing the incident’s impact across the broader retail group.

From a technical perspective, the announcement highlights concerns about system availability while leaving data confidentiality unresolved. The company’s separate systems support its claim that regional operations were unaffected.

However, the statement does not explain network segmentation, identity infrastructure, shared services, or other architectural controls that could clarify the incident’s boundaries.

Investigators are still determining whether any personal or sensitive information was compromised. Therefore, the announcement should not be interpreted as confirmation of a customer data breach or as assurance that all information remains secure.

According to MoneyWeb, TFG London has stated it will notify affected individuals or organizations if the investigation reveals that any information was compromised.

No indicators of compromise, exploited vulnerabilities, affected software versions, or recovery timelines have been published. The lack of these details limits independent technical assessment and hinders reliable attribution.

Additionally, the disclosure does not quantify financial losses, identify affected records, or establish how long attackers may have accessed the environment.

TFG’s board has said it will continue to assess the situation and, if necessary, communicate material developments through another SENS announcement.

For now, the confirmed situation is a cybersecurity incident affecting selected UK brands, ongoing IT disruption, continued store trading, engagement of external specialists, and an investigation into potential information compromise or data exposure risks.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.