TFG London has told its customers that some of their personal data was accessed in the cyber attack that struck the fashion group earlier this month.
The company, which owns Phase Eight, Hobbs and Whistles, emailed shoppers on Wednesday 28 October with an update on its investigation into the incident, which was first identified on Sunday 11 October.
Chief executive Justin Hampshire said the investigation had shown that some personal data was accessed, and that the group was contacting all of its customers as a precaution.
“This does not mean that your information was affected, and our investigation into exactly which information has been accessed is continuing,” the email said.
The message marks a step change from the group’s first public statement about the attack. When the incident was disclosed earlier in October, TFG London said a number of its IT systems had been knocked out, but it did not say at that stage that customer data had been accessed.
What information may have been accessed
According to the update, the information that may have been accessed includes contact and delivery details and order information. In some cases, it could also include limited payment information, such as the last four digits of a payment card.
The group stressed that this does not include usable payment card details. It also said its investigation had found no evidence so far that account login information or passwords were accessed.
Payment processing is handled by a third-party provider, the company added, and shopping on its websites and in its stores remains secure.
Customers do not need to take any immediate action, the email said, but shoppers were advised to stay alert to unexpected emails, phone calls or text messages. The group also reminded customers that Phase Eight would never ask for passwords or full payment card details by email, text or telephone.
“We are very sorry for any worry this incident may cause, and we thank you for your understanding,” the letter concluded, adding that the group would keep its frequently asked questions page updated as the investigation continues.
How the incident unfolded
The cyber attack was identified on Sunday 11 October and disrupted trading at the group’s brands in the days that followed. Whistles temporarily paused online orders while the company worked to secure its systems.
TFG London said at the time that it had acted immediately on identifying the incident, brought in independent cybersecurity specialists and notified the relevant authorities.
The latest email, sent more than two weeks later, is the first confirmation from the group that customer data was involved at all. It does not say how many customers may be affected, or when the investigation is expected to conclude.
The incident came in the same month as a wider wave of cyber attacks reported across UK retail, with several major high-street names disclosing intrusions in recent weeks.
What shoppers should watch for
The practical risk from this kind of incident is usually not a direct raid on a bank account. The last four digits of a card, on their own, cannot be used to make a payment, and the group has said no usable card details were taken.
The greater risk is impersonation. Contact details, delivery addresses and order histories can be used to make scam emails, calls and texts look convincing, because the fraudster already appears to know something real about the shopper. That is why the company’s warning centres on unexpected messages rather than on cards themselves.
As a general rule, shoppers should treat any message that asks them to log in, hand over a password or confirm full card details as suspect, however plausible it looks. Going directly to a retailer’s website or app, rather than following a link in a message, is the safer route, and any genuine account problem can be checked there. The same applies to calls claiming to be from a shop: hang up and call back on a published number.
None of that changes the position for any individual customer. The group has said contacting all customers does not mean each person’s information was affected, and it is still establishing exactly what was accessed.
The investigation continues, and the group says it will publish further updates on its questions page as new information becomes available.
