South African retailer Foschini Group's UK arm hit by cyber incident affecting Hobbs and Phase Eight
TFG London, the UK arm of The Foschini Group, says a cybersecurity incident identified on Sunday, 11 October 2026 is affecting some IT systems and its Phase Eight, Hobbs and Whistles brands. The company says it has no reason to believe payment information is at risk.
What the company says
TFG London, the UK arm of South African retailer The Foschini Group (TFG), identified a cybersecurity incident on Sunday, 11 October 2026 that affects some of its IT systems and specifically impacts the Phase Eight, Hobbs and Whistles brands. The company told the BBC it is investigating with external cyber security specialists. Stores remain open as normal, but some website capabilities may be unavailable while the investigation continues. TFG said it had reported the incident to the relevant UK authorities, and its operations in TFG Africa and TFG Australia were not affected.
We are actively investigating and working with external cyber security specialists.
- TFG London identifies a cybersecurity incident affecting some IT systems
- Reports say H&M is investigating claims of a ShinyHunters hack
- TFG London statement says there is no reason to believe payment information is at risk
Orders and customer data
The company warned that orders placed on or after Sunday may be delayed, but asked customers not to place their orders again. Payment processing is carried out by a third-party provider, and based on its investigation so far TFG London said there is 'no reason to believe that payment information is at risk'. It is still working to establish whether any sensitive customer information was affected. Customers whose personal information is affected will be informed directly, and the company does not believe account login information needs to be changed at this time. TheJournal.ie noted that Hobbs has a number of stores in Ireland, so customers there could also be affected.
Second UK retail hack in a week
The incident follows, by about a week, an ASOS disclosure that an unauthorised party had gained access to an employee's account and used it to reach information held on third-party platforms. ASOS confirmed that names and contact details had been accessed, but said payment card information and account passwords were not affected. A phone alert sent to ASOS customers claimed the data storage firm Snowflake had been compromised, and Snowflake later said the breach was not caused by a vulnerability or flaw with its platform. Other high street brands, including Inside Story and White Stuff, are not affected by the TFG incident.
H&M investigates a separate claim
On Monday, 12 October, reports said H&M was investigating claims of a hack by the cybercriminal group ShinyHunters. The group has previously been linked to high-profile attacks including ones targeting the FBI, Rockstar Games and Ticketmaster. BBC News described the H&M matter as separate from the TFG incident. H&M said it was aware of information circulating online and was investigating the claims.
At this time, we have not found any indications that our data environment has been compromised.
Wider pattern
Beverley Griffiths, senior lecturer in security and resilience at Bucks New University, told PA that the incident shows brands are firmly in the crosshairs of cyber attackers. BBC News reported that fashion brands ranging from Adidas to Alexander McQueen have been targeted by criminals who threaten to release customer data unless a ransom is paid. TFG said it will provide additional updates to customers as appropriate, and said on Tuesday, 13 October that its investigation is continuing.
