TFG London cyberattack disrupts Phase Eight, Hobbs and Whistles IT systems

On 13 October 2026, TFG London — the UK subsidiary of the JSE-listed South African retailer The Foschini Group (TFG) — disclosed a cybersecurity incident that had taken several of its IT systems offline across three of its best-known fashion brands. The group said it had first identified the incident on Sunday, 11 October, and had immediately activated its incident response and business continuity plans, bringing in external cybersecurity specialists to help contain it.

The disruption hit Phase Eight, Hobbs and Whistles, which are all part of TFG London. The company said its other UK labels, Inside Story and White Stuff, were not affected, and that TFG Africa — including Foschini, Markham and @home — and TFG Australia were unaffected because they run on separate systems. Physical stores "remain open and trading," TFG said, but several IT systems stayed unavailable, affecting the brands' websites and, according to reporting, online orders and returns placed from 11 October.

Data and payment exposure

TFG London said payment processing is handled by a third-party provider and that, based on its investigation so far, it had "no reason to believe that payment information is at risk," adding that customers did not need to change their passwords. It had not, however, ruled out that other customer information may have been accessed: the company said it was still determining whether sensitive data had been compromised and that it would directly notify any affected individuals or organisations if the investigation found evidence of exposure.

Response and context

The retailer reported the incident to the relevant UK authorities and said it was continuing to work with external specialists to investigate and restore services. As of its initial disclosure, no threat actor had claimed responsibility, TFG had not characterised the incident as ransomware or a confirmed data breach, and the method of initial access was unknown. The attack lands amid a sustained wave of cyberattacks on UK retailers through 2025 and 2026 — including incidents at Marks & Spencer, Co-op, Harrods and ASOS — though no link between TFG London's breach and those cases has been established.