TFG London cyberattack disrupts fashion retail systems
A cybersecurity incident has disrupted some TFG London systems, while the company investigates whether any personal information was compromised.
TFG London, the UK subsidiary of South Africa’s Foschini Group, says a cybersecurity incident has disrupted some IT systems used by the Phase Eight, Hobbs and Whistles fashion brands. 1
What happened
The company says it detected the incident on 11 October and immediately activated its incident response and business continuity plans. It has brought in external cybersecurity specialists and reported the matter to the relevant UK authorities. 1
Several IT systems remain unavailable, but TFG says its physical stores are open and trading. The group’s operations in Africa and Australia use separate systems and have not been affected, while its other UK brands, Inside Story and White Stuff, are also outside the stated impact. 1
BleepingComputer reports that the company is still investigating whether personal or other sensitive information was compromised. At the time of publication, TFG had not confirmed that customer data had been exposed, and no threat actor had publicly claimed responsibility for the incident. 2
That distinction matters. A cyberattack can disrupt operations without immediately proving that customer information was stolen, and TFG has not yet said that a data breach occurred. Customers should be cautious with unexpected messages claiming to relate to Phase Eight, Hobbs or Whistles while the investigation continues, but there is no confirmed data-exposure finding in the company’s announcement.
What happens next
TFG says it will notify affected individuals or organisations if the investigation establishes that personal or sensitive information has been compromised. The company also says it will issue further market announcements if material developments emerge. 1
The incident is another reminder that retail resilience depends on more than keeping shops open. Payment, stock, fulfilment and customer-service systems can remain disrupted even when a company’s physical locations continue trading, leaving businesses balancing continuity with a still-evolving forensic investigation.
Our opinion
TFG’s restrained update is the right baseline for a developing incident: it confirms the systems and brands affected, separates that from unconfirmed data exposure, and avoids guessing at an attacker. The key detail for customers is therefore not a dramatic breach label but the next verified update. Until TFG confirms what, if anything, was accessed, speculation risks creating more confusion than protection.
3 Photo by cottonbro studio on Pexels; used as an illustrative cybersecurity image.