Cyber attack knocks out IT systems at Hobbs, Whistles and Phase Eight
The owner of fashion brands Hobbs, Whistles and Phase Eight has been hit by a cyber attack that has knocked out a number of its IT systems, the company disclosed on Tuesday. The Foschini Group (TFG), the South African retail giant behind the three brands, said the “cybersecurity incident” was identified on Sunday 11 October and is affecting its UK business, TFG London.
In a notice to shareholders, TFG said it had activated its incident response and business continuity plans immediately and brought in external cybersecurity specialists to contain the breach. The incident has been reported to the relevant UK authorities.
What shoppers need to know
The group’s stores remain open and trading, though several IT systems are still unavailable. Customers who placed orders with Phase Eight, Hobbs or Whistles before Sunday were told their purchases would be fulfilled and delivered as expected — but anyone who ordered after Sunday could face delays. Shoppers were told there was no need to resubmit their orders.
TFG said there was “no reason to believe that payment information is at risk”, though the investigation into whether any personal or sensitive data has been compromised is still under way. The group said it would notify affected individuals or organisations if the investigation established that data had been exposed.
Returns, for now, can be made in stores. The company said it was working on a solution for postal returns and would keep customers informed.
Not all of TFG’s British brands are affected. Inside Story and White Stuff, which sit alongside the three hit brands in the TFG London portfolio, escaped the attack. The group’s operations in Africa and Australia run on separate systems and were also untouched.
A second blow for the UK business
The attack is the second cyber incident to hit TFG’s British operation this year. The company revealed in its June financial results that an earlier incident at a key concessions partner had stalled online sales for TFG London, contributing to a difficult year for the UK arm. TFG London’s retail turnover rose 29.4 per cent to £488 million in the year to 31 March 2026, but the business fell to a £21 million operating loss, partly because of an impairment at Phase Eight.
The retailer has not said what kind of incident it is dealing with, or who may be behind it. The board said it would issue a further announcement if there were material developments.
The disclosure came in a formal notice to shareholders in South Africa, where the JSE-listed group is headquartered. TFG London has grown into a significant part of the group since it bought White Stuff in October 2024, making the disruption to its IT systems a material issue for investors as well as shoppers. The group said its immediate priorities were containing the incident, recovering its IT operations and establishing whether any sensitive information had been exposed.
The wider wave
The TFG attack is the latest in a string of cyber incidents hitting British retail. Just a week ago, Asos disclosed that an “unauthorised party” had gained access to some personal data, including customers’ names and contact details — a breach linked to data storage firm Snowflake, which denied any flaw in its platform was responsible.
On Monday, reports emerged that H&M was investigating claims it had been targeted by cybercriminals, with the Swedish fashion giant confirming it was looking into an alleged incident attributed to a group known as Shinyhunters.
The wave follows the attacks on Marks & Spencer, the Co-op and Harrods last year, which prompted the government to warn companies that cybersecurity must be an “absolute priority”. TFG London’s breach adds three more household names to a list that is growing uncomfortably long — and will put the rest of the high street on alert.
