TFG London cyber incident leaves Hobbs, Whistles and Phase Eight systems offline

TFG London, the UK division of South African retailer The Foschini Group, identified a cybersecurity incident on 11 October 2026 that impacted the IT infrastructure supporting Phase Eight, Hobbs and Whistles. As TechSec Observer reported on 13 October, the breach has impaired online services for these three key fashion brands, with investigations ongoing into potential data exposure.

Root cause

The specific vulnerability or vector exploited by the attackers has not been disclosed. TFG London stated that the incident affected IT systems used by the three named brands, while other entities within its UK portfolio, including Inside Story and White Stuff, were not impacted. Operations in TFG Africa and TFG Australia run on separate systems and remain unaffected.

Attack path

Details regarding how the threat actors gained access to the network are currently unknown. The company did not specify the type of attack or the methods used to breach its defences. TFG London activated its incident response and business continuity plans immediately upon detection, bringing in external cybersecurity specialists to contain the activity.

Affected versions

The incident impacted IT systems supporting Phase Eight, Hobbs and Whistles. No specific software versions, CVE identifiers or product names were cited in the initial disclosure. The outage has rendered several website functions unavailable for customers of these brands.

Mitigation

• Engaged external cybersecurity specialists to contain the incident.
• Activated internal incident response and business continuity plans.
• Notified relevant UK authorities regarding the breach.
• Confirmed payment processing is handled by a third-party provider, isolating financial data from the compromised systems.

What it means for organisations

Operations teams should verify which internal systems share infrastructure with affected services to assess blast radius. Supply chain managers must confirm whether third-party vendors, such as payment processors, are isolated from primary IT networks. Communications leads need to prepare templates for customer notifications regarding potential data exposure. Legal and compliance officers should review notification timelines for regulatory bodies. Incident response teams should validate that continuity plans are tested and accessible during active breaches.

Background: Supply chain attacks

Supply chain attacks in cyber security exploit the trust you place in third-party software components. Attackers inject malicious code into legitimate updates or build pipelines. You receive the payload as if it were benign. Defending requires verifying code origins, isolating build environments and treating all external inputs as hostile.

Read the full guide: Supply chain attacks in cyber security: how they work and how to stop them

What to do and how to stay safe: TFG London

• Monitor official channels from affected vendors for updates on service restoration and data safety.
• Review recent transaction histories for unauthorised charges, even if payment systems are reportedly secure.
• Enable multi-factor authentication on all accounts associated with the affected brands to reduce credential theft risk.
• Watch for phishing attempts that may reference the incident to trick users into revealing login details.

General security guidance from the TechSec Observer newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Are physical stores affected by the TFG London cyber incident?

No, TFG London stated that all stores remain open and trading as normal despite the IT system outages.

Is customer payment information at risk?

The company stated it has no reason to believe payment details are at risk, as processing is handled by a third-party provider.

Which brands were not affected by the breach?

Inside Story and White Stuff were not affected, nor were TFG’s operations in Africa and Australia.