Hobbs and Whistles owner TFG London hit by cyberattack, systems offline

TFG London confirms cyberattack

South African retail giant The Foschini Group (TFG) confirmed on Tuesday that its UK business, TFG London, discovered a cybersecurity incident on October 11 affecting all three of its fashion brands: Hobbs, Phase Eight, and Whistles. Two days later, several IT systems remain unavailable as the company continues to investigate the scope of the breach.

Stores remain open, but some website functions may be unavailable. Customers have been warned that orders placed on or after Sunday could be delayed.

Response and data concerns

TFG said it immediately activated its incident response and business continuity plans, brought in external cybersecurity specialists, and notified the relevant UK authorities. The company has yet to disclose how attackers gained access, whether ransomware was involved, or when it expects full restoration of its systems.

Payment processing is handled by a third-party provider, and TFG London said it has no reason to believe payment information is at risk. However, it is still investigating whether any personal or sensitive data was compromised, and said it will notify affected individuals or organizations if evidence of a breach is found.

Wave of retail cyberattacks

The disruption appears confined to the three fashion brands. TFG said its White Stuff and Inside Story businesses are unaffected, as are its operations in Africa and Australia, which run on separate IT systems.

The attack follows a difficult stretch for fashion retailers. Last week, ASOS confirmed a hacker gained access to an employee account by impersonating a trusted contact and obtained login credentials, reaching third-party platforms holding customer names and contact details. Meanwhile, H&M is reportedly examining allegations involving a limited amount of company data linked to the ShinyHunters cybercrime group, though it said it found no indication its systems were compromised. No evidence currently links the three incidents.

Sources: Theregister