TFG London, the UK arm of The Foschini Group, has been hit by a cyberattack that interrupted IT systems across its Phase Eight, Hobbs, and Whistles brands. The South Africa-based retail group first identified the breach on October 11, 2026, and informed shareholders on October 13. Despite technical disruptions, stores remained open for business. Inside Story and White Stuff were unaffected, and operations in Africa and Australia escaped impact thanks to separate systems.
What We Know So Far
TFG activated both its incident response and business continuity plans immediately after detecting the intrusion. It has brought in external cybersecurity experts and has notified UK authorities. The ongoing investigation is probing whether customer or other sensitive data was accessed in the breach. As things stand, some web services are still offline, and orders made on or after October 11 may experience delays. Customers have been asked not to re-submit orders placed in that window. Orders submitted before October 11 are expected to be fulfilled normally.
Payment processing is handled by a third-party provider, and based on current findings, there’s no indication that payment details were compromised. However, TFG London has not ruled out the exposure of other customer data. People whose data may have been affected will be notified directly. Crucial details about the attack remain unclear: the identity of the attackers, how they gained access, whether ransomware was involved, and when full system recovery will be achieved.
Impact and Broader Context
Though the disruption is limited to part of TFG’s UK operations, scale and severity are still being assessed. Which specific UK applications failed, which systems were compromised across the three affected brands, and whether data was stolen or only rendered inaccessible remain unanswered.
This cyberincident follows previously disclosed trouble for the group. In its financial results published in June, TFG reported a cyberincident involving a key online concession partner. That event formed part of mounting pressures on its UK business, including a sharp 65.4% drop in adjusted operating profit when excluding brand impairments and acquisition expenses. Retail as a sector has also been under strain lately from similar security threats—recently, Marks & Spencer saw payment and collection services disrupted by an attack, while a supplier data breach at Harrods exposed customer records.
TFG’s leadership now faces urgent questions: how did the breach happen, what’s been stolen, and when can customers expect full systems back online with confidence that their information is safe?
For customers, the message is to monitor communications from the companies for notices of data exposure and to expect delays for orders placed during the affected window. Retail analysts will be watching how deeply this incident hits TFG’s UK operations in the months ahead—both in terms of financial loss and reputational damage. How the company strengthens its crisis and cybersecurity posture going forward could become a benchmark for regional retail resilience. What remains to be seen: the full fallout depends on the technical details TFG releases and whether regulators demand further disclosure.
Analysis: This attack underscores how quickly cyber threats can amplify in retail—where multiple brands may share systems and vulnerabilities. Even when core financial functions are handled externally, customer trust hinges on the integrity of all systems. Moving forward, retail groups with fragmented IT infrastructures must prioritize transparency, layered resilience, and timely disclosure to limit disruption to operations, customer relationships, and brand reputation.
