Fashion Retailer TFG London Hit by Cyberattack

"Stores are open as normal but some of our brand's website capabilities may not be available as the investigation continues," the company said.

TFG London confirms cybersecurity incident

South African retail giant The Foschini Group (TFG) confirmed on Tuesday that its UK business, TFG London, discovered a cybersecurity incident on October 11 that affected three of its fashion brands: Hobbs, Phase Eight and Whistles. Two days later, the company said several IT systems remained unavailable while investigators work to determine whether any personal or sensitive information has been compromised.

Customer impact: orders, websites, and payments

TFG said the incident has not forced stores to close, but warned customers some website functions may be unavailable. An email seen by The Telegraph told customers that orders placed on or after Sunday could be delayed. In a separate customer email, TFG London said a third‑party provider handles payment processing and that, based on its investigation so far, it has "no reason to believe payment information is at risk."

Which brands and regions were affected

TFG characterised the disruption as confined to Hobbs, Phase Eight and Whistles. The company said other UK brands, White Stuff and Inside Story, were unaffected. TFG also reported its operations in Africa and Australia were unaffected because those businesses run on separate IT systems.

Response: incident response plans, outside specialists and authorities

TFG said it immediately activated its incident response and business continuity plans, brought in external cybersecurity specialists, and notified the relevant UK authorities. The Register contacted the Information Commissioner's Office (ICO) to confirm but did not receive a response. TFG has said it will notify affected individuals or organisations if it finds evidence of a compromise, but has not disclosed how attackers gained access, whether ransomware was involved, or when it expects to have all systems fully restored. The company did not respond to The Register’s questions.

Context: ASOS, H&M and a busy week for fashion retailers

The TFG London incident arrives amid several recently reported problems in the fashion sector. Last week ASOS customers received a notification informing them the online retailer had been hacked; ASOS confirmed an attacker had gained access to an employee account by impersonating a trusted contact and obtaining login credentials, then used those credentials to access third‑party platforms holding customer names and contact details. Separately, The Times reported H&M is investigating claims it was targeted by the notorious ShinyHunters cybercrime group; The Times said the allegations involved a limited amount of company data, and H&M stressed it had found no indication its systems had been compromised. There is currently no evidence linking the incidents at TFG London, ASOS and H&M.

What this means for customers, regulators, and security teams

• Customers: Expect some online interruptions and possible order delays for purchases placed on or after Sunday; payment cards are currently handled by a third‑party processor and TFG London has stated it currently sees no reason to believe payment information is at risk, while other categories of customer data remain under investigation.
• Regulators and watchdogs: TFG notified relevant UK authorities and The Register sought confirmation from the ICO but received no reply; the company has committed to notifying affected individuals or organisations only if evidence of compromise is found.
• Security teams at retailers: TFG's immediate activation of incident response and business continuity plans and the engagement of external cybersecurity specialists underline the priority placed on containment and investigation; key unanswered technical questions include the initial access vector, whether ransomware was used, and the timetable for full system restoration.

With three major fashion businesses publicly linked to cyber trouble in little more than a week, "October's hottest retail trend appears to be incident response," The Register observed — and TFG London has left two practical next steps on the record: continue its investigation to establish whether data was exposed, and notify affected parties if that investigation finds proof of compromise.

Original story