Summary
- TFG London has contacted customers following the 11 October intrusion.
- Potentially affected fields include contact details, order histories and limited card information.
- The company says it has found no evidence that account passwords were accessed.
TFG London, the owner of Hobbs, Whistles and Phase Eight, has told customers that personal information may have been accessed during a cyberattack identified on 11 October. The business has also acknowledged possible access to employee records, extending the incident beyond the operational disruption described when the affected systems were first taken offline.
Chief executive Justin Hampshire’s customer communication, distributed on 28 October, says the company is contacting customers as a precaution while specialists determine which records were reached. The company has emphasised that contacting all customers as a precaution does not establish that each recipient’s personal information was compromised. The company has continued investigating the precise exposure and has notified relevant authorities.
The potentially affected categories include names, email and postal addresses, telephone numbers, delivery information and details of purchases. In some cases, records may contain the final four digits of a payment card. TFG London says those truncated card details are not sufficient on their own to complete a payment, and it has found no evidence that customer account passwords or login information were accessed. These are current investigative findings rather than a complete independent account of the attackers’ access.
When the attack was identified, the group reported disrupted IT systems supporting Hobbs, Whistles and Phase Eight, although physical stores remained open. Website functions and online orders were interrupted in the following days. TFG London subsequently said its websites were again accepting orders and returns. The customer-data disclosure is a further development in the same incident, while the business continues to establish which records were actually reached.
An order history can reveal more than a single customer identifier. Purchase dates, products, delivery addresses and contact details may enable convincing impersonation of a familiar retailer, even when full payment card information is unavailable. The company has warned customers about unexpected messages and requests for information. That warning is proportionate to the types of records potentially exposed; it does not establish that a subsequent fraud campaign has occurred.
The group also owns Inside Story and White Stuff, but those brands were not affected by the incident, according to TFG London. The separation is consistent with the original account that the compromised systems served the three named fashion brands. Notification of customers across affected brands should not be mistaken for confirmation that every record or every group business was exposed.
The information gathered during forensic review will determine which notification and accountability obligations apply to the different records held by the business. The retailer has brought in independent cybersecurity specialists and informed relevant government authorities. It has not publicly named an intrusion method, a responsible group or a confirmed volume of extracted information. The customer warning about suspicious calls and messages is based on the kinds of contact and purchase records potentially exposed, rather than evidence of a particular subsequent phishing campaign. The affected-brand distinction also places limits on the scope of any eventual notification: the three fashion brands shared impacted IT services, but the company says Inside Story and White Stuff were outside the affected systems.
Employee information raises a separate question from retail order histories. Human resources systems may involve different access restrictions and record categories, so the company will need to distinguish the actual employee files reached from customer transaction records. Its update does not establish how many people were affected or whether additional fields such as identification documents and salaries were involved. The exposed dataset remains under investigation.
In its initial 13 October disclosure, The Foschini Group said investigators were still assessing whether personal information had been compromised. The 28 October customer email goes further by specifying categories of data that may have been accessed while warning that individual notifications do not establish individual compromise. TFG London says it will update customer information as the investigation develops, and has found no evidence that login passwords were accessed.
