TFG London Cyber-Attack Disrupts Three UK Fashion Brands, Exposing Customer Data
Developing story first seen 1 hour ago
TFG London, which operates the fashion retailers Hobbs, Whistles, and Phase Eight, has been hit by a cyberattack discovered on 11 October that compromised its IT systems and customer-facing digital infrastructure. Customer data may have been exposed in the breach, prompting the company to suspend online ordering across all three brands as a precautionary measure whilst investigating the incident.
Multiple systems remain offline more than two days after the attack was identified, forcing the company to warn customers that orders placed since Sunday will face processing delays. The incident exemplifies the broader vulnerability facing major retail operations, where cybercriminals increasingly target established brands to extract sensitive customer information and demand ransom payments. The attack occurs amid a wider pattern of security breaches affecting high-profile retailers, highlighting that scale and brand reputation offer little protection against determined cyber threats.
- Cyberattack discovered 11 October affects Hobbs, Whistles, and Phase Eight; customer data potentially exposed
- Online ordering suspended across all three brands; multiple IT systems remain offline
- Warns customers of order delays; reflects growing threat to retail sector from extortion-focused cybercriminals
New here? Start with this
TFG London is a British fashion company that owns three well-known brands sold on the high street: Hobbs, Whistles, and Phase Eight. The company has recently been hit by a cyberattack, in which criminals broke into its computer systems and potentially accessed customer information.
Because of this attack, TFG London has shut down its online shopping platforms across all three brands as a safety measure whilst it investigates and repairs the damage. This means customers cannot currently place orders online, and those who did place orders recently have been warned that their purchases may take longer than usual to arrive.
This attack highlights a growing threat facing major retailers worldwide, as cybercriminals increasingly target well-established companies to steal valuable customer data and extort ransom money. Even large brands with strong reputations are vulnerable to such attacks, showing that scale and success offer little protection against determined cyber threats.
Full account
Three major UK fashion retailers have become the latest targets of cyber-attack in what appears to be a coordinated surge against the retail sector. TFG London, the British division of South African retail conglomerate The Foschini Group, disclosed that its systems fell victim to a security breach discovered on Sunday, specifically compromising the digital operations of Phase Eight, Hobbs and Whistles. The company's physical stores have remained open throughout the incident, though portions of its web-based capabilities have been taken offline and online ordering has been suspended pending investigation. Two other brands owned by TFG London—White Stuff and Inside Story—remain unaffected, as do the group's operations across Africa and Australia, which operate on separate infrastructure.
The breach arrives during a particularly vulnerable period for fashion retailers. Days earlier, Asos confirmed that attackers had gained access to customer data including names, addresses and browsing information by compromising an employee account through social engineering. Separately, H&M disclosed it was examining claims of a potential attack by the ShinyHunters hacking collective, though the retailer maintains it has found no evidence of actual data compromise. The current wave of attacks reflects a broader problem afflicting British retail: Marks & Spencer, the Co-operative Group and Harrods all suffered significant breaches in recent months that led to stock shortages and forced digital service shutdowns.
TFG London's investigation remains ongoing as to whether customer personal information has been exposed. The company has engaged external cybersecurity specialists and reported the incident to relevant UK authorities. In communications with customers, TFG London stated there is presently no reason to believe payment card data has been compromised, as a third-party provider handles payment processing separately from the breached systems. The group has committed to notifying any individuals whose data may have been accessed once its investigation concludes. The attackers' method of entry, whether ransomware was deployed, and timelines for full system restoration have not been disclosed.
The pattern of attacks has prompted cybersecurity analysts to highlight systemic weaknesses across the retail industry. Experts have noted that retailers present particularly lucrative targets due to their vast customer databases and sprawling networks of interconnected payment platforms, external suppliers and third-party technology providers—each junction representing a potential vulnerability to exploitation. Industry observers have characterised the current situation as revealing fundamental questions about retail sector resilience, with the ability to detect breaches rapidly, respond effectively and maintain customer communication identified as the true test of operational preparedness rather than immunity from attack itself.
Where outlets differ
Source 2 specifies the breach was discovered on October 11 and notes systems remained offline two days later (indicating Tuesday publication), whilst Sources 1 and 3 refer only to 'Sunday' without precise dating
Source 1 features commentary from NordVPN's chief technology officer emphasising supply chain vulnerabilities, whereas Source 3 includes academic and corporate cybersecurity analysts discussing resilience testing and industry patterns
Source 1 references previous attacks on M&S, Co-op and Harrods from the preceding year; Source 3 cites Adidas and Alexander McQueen as examples of fashion brands targeted by extortion attempts
Source 2 provides technical details of how the Asos breach occurred through employee impersonation, whilst Sources 1 and 3 mention this method more generally
Source 2 emphasises the reassurance that a third-party payment processor handles transactions and was not breached; this point is mentioned but less prominent in Sources 1 and 3
Only Source 3 includes the analyst comparison of attacks 'arriving like buses'—a clustering phenomenon suggesting either coordinated targeting or exploitation of common vulnerabilities
Coverage
- The Guardian — TFG London probes cyber-attack that may have exposed customer data
- The Register — Owner of fashion brands Hobbs and Whistles joins autumn pwned collection
- BBC Technology — Phase Eight and Hobbs owner hit by cyber-attack, as H&M probes separate hack claim
Africa Business Culture Cybersecurity Fashion Software Technology UK World