The owner of upmarket fashion retailers Hobbs, Whistles and Phase Eight has disclosed a significant cyber-security incident affecting its operations. TFG London, the United Kingdom division of The Foschini Group retail conglomerate, detected the breach on Sunday, with the attack specifically targeting systems serving its three fashion brands.
In a statement to a national broadcaster, TFG London confirmed it was conducting an active investigation in collaboration with external cyber-security specialists. The company noted that physical stores continue to operate normally, though some online capabilities remain unavailable as remediation efforts proceed. The retailer apologised for service disruptions and pledged to furnish customers with further information as the investigation develops.
TFG London informed affected customers via email that preliminary findings suggest payment card information was not compromised in the incident. However, the company acknowledged the ongoing need to establish whether any sensitive personal data relating to customers had been accessed during the breach.
What information may have been exposed?
According to the email reviewed by news agency PA, customers whose personal information was affected will receive direct notification. The company advised that account password changes were not deemed necessary at the present time, indicating confidence that login credentials remained secure.
This incident reflects a troubling pattern in the retail sector. Beverley Griffiths, senior lecturer in security and resilience at Bucks New University, told PA that the attack demonstrates that
major brands are firmly in the crosshairs of cyber attackers. High-profile fashion companies including Adidas and Alexander McQueen have previously fallen victim to extortion attempts, where criminals threaten to release customer data unless paid substantial ransoms.
Griffiths emphasised that
no organisation is immune, so the real test of resilience is how quickly a business can detect an incident, respond and recover while keeping its customers informed. She advised customers to remain alert and exercise caution regarding unsolicited communications.
H&M investigating separate cyber-attack claim
Separately, fashion retailer H&M disclosed on Monday that it was examining allegations of a breach perpetrated by ShinyHunters, a cyber-criminal group with a documented history of high-profile attacks. The group has previously been linked to breaches affecting the FBI, Rockstar Games and Ticketmaster.
H&M stated to a national broadcaster:
We are aware of information circulating online regarding a potential cyber security incident and are currently investigating the claims. At this time, we have not found any indications that our data environment has been compromised.
The H&M investigation arrives amid heightened concern about retail sector vulnerabilities. Asos customers were informed the previous week that the online fashion and beauty retailer had experienced a breach, with hackers employing an unusual tactic: they sent ransom demands directly to customer devices via push notifications.
How did the Asos breach differ from typical attacks?
Cyber-security specialists highlighted that the Asos incident represented an unprecedented approach to extortion. Rather than traditional communication channels, hackers effectively converted the retailer's own app notification system into a ransom demand mechanism, reaching thousands of users simultaneously.
The scope of the Asos breach expanded beyond initial disclosures. When cyber criminals contacted a broadcaster with evidence of their access, it emerged that hackers possessed far more comprehensive customer information than Asos had initially indicated. Rather than merely basic contact details, the breach encompassed names, addresses, phone numbers, email addresses and customer search histories, revealing the depth of data exposure.
What does this mean for the broader retail sector?
The concentration of attacks on major retailers underscores systemic vulnerabilities in how fashion and e-commerce companies manage customer data. Earlier in 2026, three UK airports operated by Manchester Airports Group experienced a cyber-attack affecting 8.7 million customers, with attackers accessing email addresses, phone numbers and vehicle registration numbers, though financial data remained protected.
The pattern extends beyond retail and travel sectors. English National Ballet disclosed in August 2026 that customer contact information was leaked following a compromise at provider Beacon CRM, though passwords and payment details were not exposed in that incident.
Griffiths' assessment that resilience depends on detection speed, response effectiveness and customer communication transparency has become increasingly relevant as criminal groups refine their tactics and expand their targeting across multiple industries.
Key Facts
- TFG London detected a cyber-security incident on Sunday affecting Phase Eight, Hobbs and Whistles brands, with physical stores operating normally but some website functions unavailable
- The retailer stated payment card information was not believed to have been compromised, though investigation into potential personal data exposure continues
- H&M is separately investigating breach claims from ShinyHunters, a group previously linked to attacks on the FBI, Rockstar Games and Ticketmaster
- The incidents follow a recent Asos breach where hackers sent ransom demands via customer app notifications, an unprecedented tactic in extortion attempts
- Cyber-security experts emphasise that rapid detection, response and customer communication are critical measures of organisational resilience against such attacks
