Summary
- TFG London detected an incident affecting Hobbs, Whistles and Phase Eight systems.
- Stores remain open; several IT systems are unavailable.
- The company has not confirmed that customer or other sensitive data was stolen.
The owner of British fashion brands Hobbs, Whistles and Phase Eight has reported a cybersecurity incident affecting several IT systems at its UK subsidiary, TFG London. In a regulatory announcement issued on 13 October, South Africa’s The Foschini Group said the incident was identified on 11 October and had prompted its business continuity and incident response procedures.
TFG said its stores remained open and trading, although several systems were unavailable. It engaged external cybersecurity specialists and reported the matter to relevant UK authorities. The company has not identified the attacker or described the intrusion method, and its continuing investigation includes whether any personal or other sensitive information was compromised.
The disruption is confined to specified businesses within the group’s UK portfolio, according to the announcement. Inside Story and White Stuff are not affected, while TFG’s operations in Africa and Australia use separate systems and have also been excluded from the reported impact. The businesses have a common owner but, according to TFG, do not all share the affected systems.
Further reporting indicates online order and website functions were disrupted for some of the affected brands, while physical shops continued serving customers. These accounts of operational disruption should not be mistaken for confirmation of the cause or the scope of any data loss. TFG has stated that it has no reason to believe payment information is at risk, with payment processing handled separately, but its investigation of other information remains open.
Retail incidents can affect several operational layers at once. Websites, stock visibility, distribution, customer communications and returns may depend on overlapping services, while a store can continue taking some transactions through arrangements that do not require every back-office application to be online. Business continuity consequently depends on separating essential trading processes from unavailable systems and understanding how much work can be carried out manually.
The data question has a different timetable. An investigation may first focus on containment and whether attackers remain present, then review access logs, affected accounts and records. A company may establish that a system was disrupted without immediately being able to determine whether information was accessed or extracted. TFG says it will notify affected individuals or organisations if its investigation finds sensitive information was compromised.
TFG’s listed-company disclosure and any eventual personal-data notification would answer different questions. Shareholders need information about operational or financial consequences that may be material to the listed parent, while individuals potentially affected by a personal-data breach may require a separate explanation of the information involved and the available response. At the time of the announcement, TFG had not completed the investigation needed for the second category. An early public statement can therefore describe system disruption without confirming a data breach.
Online retail creates particularly visible consequences because a loss of ordering functionality can affect sales immediately, even where stores remain open. Customer service teams may also struggle to obtain order histories or issue timely updates if associated systems are unavailable. Those practical effects are distinct from any eventual legal notification. The company’s statement that other brands use separate systems is an indication of the stated scope of impact; it is not proof that every technical dependency has been independently assessed or that no further changes will be discovered. Later updates will need to be compared with the initial chronology and the findings of external investigators.
The incident follows other security disclosures involving UK retailers, but proximity in time is not evidence of common attackers or a shared technique. TFG’s stock-market announcement reports a specific disruption at the three named brands. The board said it will assess material developments and issue further regulatory updates if required as technical recovery and the inquiry continue.
