Hobbs, Whistles and Phase Eight owner apologises after cyber incident hits its IT systems
TFG London, the UK arm of South Africa's Foschini Group, said it identified a cybersecurity incident on Sunday affecting its Phase Eight, Hobbs and Whistles brands, in the second attack on a British retailer within a week.
The owner of the Hobbs, Whistles and Phase Eight fashion brands has apologised to customers after a cybersecurity incident knocked out some of its IT systems, in the second such attack to strike a British retailer within a week.
TFG London, the UK subsidiary of the South African retail conglomerate The Foschini Group, disclosed on Tuesday that it identified the incident on Sunday, 11 October, affecting some of its IT systems and specifically its Phase Eight, Hobbs and Whistles brands. The group said it is actively investigating with external cybersecurity specialists and has reported the incident to the relevant UK authorities.
"Stores are open as normal," the company said, but some website capabilities may not be available while the investigation continues. TFG London said there is no reason to believe that payment information is at risk. In an email to customers seen by PA, the company said it was working to identify whether any sensitive information relating to customers was impacted, that anyone whose personal information was affected would be informed directly, and that customers do not need to change their account login information at this time.
Stores are open as normal.TFG London statement, 13 October 2026
Customers who ordered from Phase Eight, Hobbs or Whistles before Sunday were told their purchases would be processed and delivered as normal. Orders placed after Sunday may face delays, but customers were told there is no need to resubmit them. Returns can be made in stores as usual, while the company works on a solution for postal returns.
The group's other UK brands, Inside Story and White Stuff, are not affected, and neither are its operations in Africa and Australia, which run on separate systems. BleepingComputer, which reported the disclosure on Tuesday, said no threat actor had publicly claimed the incident and that TFG London had not confirmed any customer data exposure. TFG London's retail turnover rose 29.4 per cent to 488 million pounds in the year to 31 March 2026, TechCentral reported, citing Drapers.
The incident comes a week after the online fashion retailer ASOS said an unauthorised party had gained access to some personal data, including customers' names and contact details. On Monday, reports emerged that H&M was investigating a claim that it had been targeted by cybercriminals.
TFG first entered the UK market in 2015, when it bought Phase Eight, and has since added Whistles, Hobbs, Inside Story and White Stuff to its London-headquartered business, which employs more than 3,000 people.
None to date. The Journal corrects errors promptly and transparently. Read our corrections policy.
