TFG London Cyberattack Disrupts Hobbs, Whistles and Phase Eight

The TFG London cyberattack has disrupted IT systems serving fashion retailers Hobbs, Whistles and Phase Eight. Several systems remained unavailable when the company disclosed the incident on October 13, although physical stores continued trading.

The company detected the attack on October 11 and launched its incident response and business continuity plans. It also brought in external cybersecurity specialists to help contain the threat.

Three Fashion Brands Face IT Disruption

TFG London said the incident affected systems used by Phase Eight, Hobbs and Whistles. However, its other brands, Inside Story and White Stuff, remained unaffected.

The company also said the attack had not affected operations in Australia or Africa.

Despite the IT disruption, customers could still visit physical stores. The disclosure did not provide a timetable for restoring the unavailable systems.

TFG London is the UK subsidiary of South Africa’s The Foschini Group. Its portfolio includes fashion and homeware businesses. As of mid-2026, TFG London operated 649 retail locations globally and reported annual sales of £488 million, approximately $646 million.

Customer Data Exposure Remains Unconfirmed

Investigators are examining whether the TFG London cyberattack compromised customer information. At the time of disclosure, the company had not confirmed any exposure.

TFG London said it would notify affected individuals or organizations if the investigation established that their data was involved.

Meanwhile, no threat actor had publicly claimed responsibility for the incident. The company had also not disclosed how the attackers gained access.

These unanswered questions leave the extent of the incident unclear. For now, the confirmed impact concerns IT availability across the three affected brands.

Incident Follows Separate ASOS Data Breach

The disruption follows a recently disclosed breach at fellow UK fashion retailer ASOS.

In that incident, attackers sent unauthorized push notifications to mobile app users. ASOS subsequently confirmed that social engineering had enabled the theft of an employee’s login credentials.

The attackers then accessed customer information, including names, contact details and account data.

However, the available information does not establish any connection between the ASOS breach and the TFG London incident. TFG London has not confirmed the same entry method or any customer data theft.

H&M Investigates Separate Attack Claims

Separately, H&M has been investigating online allegations of a cybersecurity incident.

An attacker claiming affiliation with ShinyHunters threatened to publish allegedly stolen information. However, H&M said its investigation had found no indication that its data environment had been compromised.

Those allegations therefore remain unconfirmed and do not establish a link to the disruption at TFG London.

While TFG London continues its investigation, customers of Hobbs, Whistles and Phase Eight should remain cautious about unexpected messages requesting passwords or payment information. Such precautions do not mean that customer data theft has occurred.