TFG London Cyber-Attack Disrupts Three UK Fashion Brands, Exposing Customer Data
Developed over time first seen 1 day ago
TFG London is investigating a cyber-security incident affecting IT systems linked to Hobbs, Whistles and Phase Eight. Its shops remain open, though some website functions may be unavailable; the episode adds to a series of reported cyber-attacks affecting fashion retailers.
The company said it does not believe customers’ payment information was affected and has not advised them to change their login details. It is checking whether other sensitive customer information was impacted and says it will contact affected people directly. The incident was identified on Sunday and is being investigated with external specialists; separately, H&M is examining a hacking claim but says it has found no sign its data environment was compromised, while Asos recently informed customers of a breach.
- TFG is investigating an incident affecting three fashion brands.
- Shops remain open, but some website functions may be unavailable.
- TFG says payment information is not believed to be affected.
New here? Start with this
TFG London is a British fashion company that owns three well-known brands sold on the high street: Hobbs, Whistles, and Phase Eight. The company has recently been hit by a cyberattack, in which criminals broke into its computer systems and potentially accessed customer information.
Because of this attack, TFG London has shut down its online shopping platforms across all three brands as a safety measure whilst it investigates and repairs the damage. This means customers cannot currently place orders online, and those who did place orders recently have been warned that their purchases may take longer than usual to arrive.
This attack highlights a growing threat facing major retailers worldwide, as cybercriminals increasingly target well-established companies to steal valuable customer data and extort ransom money. Even large brands with strong reputations are vulnerable to such attacks, showing that scale and success offer little protection against determined cyber threats.
Full account
Three major UK fashion retailers have become the latest targets of cyber-attack in what appears to be a coordinated surge against the retail sector. TFG London, the British division of South African retail conglomerate The Foschini Group, disclosed that its systems fell victim to a security breach discovered on Sunday, specifically compromising the digital operations of Phase Eight, Hobbs and Whistles. The company's physical stores have remained open throughout the incident, though portions of its web-based capabilities have been taken offline and online ordering has been suspended pending investigation. Two other brands owned by TFG London—White Stuff and Inside Story—remain unaffected, as do the group's operations across Africa and Australia, which operate on separate infrastructure.
The breach arrives during a particularly vulnerable period for fashion retailers. Days earlier, Asos confirmed that attackers had gained access to customer data including names, addresses and browsing information by compromising an employee account through social engineering. Separately, H&M disclosed it was examining claims of a potential attack by the ShinyHunters hacking collective, though the retailer maintains it has found no evidence of actual data compromise. The current wave of attacks reflects a broader problem afflicting British retail: Marks & Spencer, the Co-operative Group and Harrods all suffered significant breaches in recent months that led to stock shortages and forced digital service shutdowns.
TFG London's investigation remains ongoing as to whether customer personal information has been exposed. The company has engaged external cybersecurity specialists and reported the incident to relevant UK authorities. In communications with customers, TFG London stated there is presently no reason to believe payment card data has been compromised, as a third-party provider handles payment processing separately from the breached systems. The group has committed to notifying any individuals whose data may have been accessed once its investigation concludes. The attackers' method of entry, whether ransomware was deployed, and timelines for full system restoration have not been disclosed.
The pattern of attacks has prompted cybersecurity analysts to highlight systemic weaknesses across the retail industry. Experts have noted that retailers present particularly lucrative targets due to their vast customer databases and sprawling networks of interconnected payment platforms, external suppliers and third-party technology providers—each junction representing a potential vulnerability to exploitation. Industry observers have characterised the current situation as revealing fundamental questions about retail sector resilience, with the ability to detect breaches rapidly, respond effectively and maintain customer communication identified as the true test of operational preparedness rather than immunity from attack itself.
Where outlets differ
Source 2 specifies the breach was discovered on October 11 and notes systems remained offline two days later (indicating Tuesday publication), whilst Sources 1 and 3 refer only to 'Sunday' without precise dating
Source 1 features commentary from NordVPN's chief technology officer emphasising supply chain vulnerabilities, whereas Source 3 includes academic and corporate cybersecurity analysts discussing resilience testing and industry patterns
Source 1 references previous attacks on M&S, Co-op and Harrods from the preceding year; Source 3 cites Adidas and Alexander McQueen as examples of fashion brands targeted by extortion attempts
Source 2 provides technical details of how the Asos breach occurred through employee impersonation, whilst Sources 1 and 3 mention this method more generally
Source 2 emphasises the reassurance that a third-party payment processor handles transactions and was not breached; this point is mentioned but less prominent in Sources 1 and 3
Only Source 3 includes the analyst comparison of attacks 'arriving like buses'—a clustering phenomenon suggesting either coordinated targeting or exploitation of common vulnerabilities
Coverage
- The Guardian — TFG London probes cyber-attack that may have exposed customer data
- The Register — Owner of fashion brands Hobbs and Whistles joins autumn pwned collection
- BBC Technology — Phase Eight and Hobbs owner hit by cyber-attack, as H&M probes separate hack claim
Africa Business Culture Cybersecurity Fashion Software Technology UK World