As of mid-2026 The Foschini Group operated 649 retail locations globally and reported annual sales of £488 million ($646M); on October 11 its UK subsidiary, TFG London, detected a cyberattack that has put several of the subsidiary’s IT systems out of service.
TFG London confirms cyberattack; several systems remain unavailable
TFG London disclosed that it detected a cybersecurity incident on October 11 and immediately activated its incident response and business continuity plans. The company said several IT systems used by the Phase Eight, Hobbs, and Whistles brands remain unavailable, although physical stores continue to serve customers.
Operational scope: Phase Eight, Hobbs, Whistles — and where systems were untouched
The impact is limited, as reported, to IT systems for the premium fashion brands Phase Eight, Hobbs, and Whistles. TFG London stated the incident has not affected the group’s other brands, Inside Story and White Stuff, nor its operations in Australia and Africa. Physical retail locations for the affected brands remain open to customers despite the IT disruption.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleResponse and investigation: incident plans, external experts, and customer-notification promise
On detecting the incident on October 11, TFG London activated incident response and business continuity plans and engaged external cybersecurity experts to help contain the threat. The company said it is investigating whether any customer information was compromised and pledged to notify affected individuals or organizations if customer data has been affected.
BleepingComputer reported that it could not find any threat actor publicly claiming responsibility for the TFG London breach.
Context in UK retail: recent ASOS breach and H&M claims under review
The TFG London incident follows other recent cyber-related events in UK and global retail noted by reporting. UK fashion retailer ASOS suffered a data breach after attackers sent push notifications to users of its mobile app; ASOS later confirmed the attackers used social engineering to steal an employee’s login credentials and gained unauthorized access to customer data including names, contact details, and account information.
Separately, rumors circulated about an attack at Swedish multinational H&M, with an online claim by an attacker saying they were with the ShinyHunters group and threatening to leak stolen data. An H&M spokesperson told BleepingComputer: “We are aware of information circulating online regarding a potential cyber security incident and are currently investigating the claims. At this time, we have not found any indications that our data environment has been compromised.”
What this means for customers, security teams, and TFG London’s operations
- Customers of Phase Eight, Hobbs, and Whistles — Remain alert for potential phishing and social engineering attempts; TFG London is investigating and will notify any individuals or organizations if their data has been affected.
- Security and IT teams — The company deployed incident response and business continuity plans and brought in external cybersecurity experts; containment and forensic investigation remain active priorities.
- TFG London’s broader operations and investors — The disruption is currently described as limited to specific brands and UK IT systems; Inside Story, White Stuff, and the group’s Australia and Africa operations have been reported as unaffected.
TFG London’s next public steps are straightforward and consequential: complete the forensic investigation, determine whether customer data was exposed, and notify anyone affected. For now, stores remain open and the company continues work to restore unavailable systems while promising to inform impacted parties if the probe finds data compromise.
