CONFIRMED: The Foschini Group (TFG) disclosed the incident to shareholders on 13 October 2026. The company has not said how it happened or who was behind it, and is still investigating whether personal data was taken.
TFG London, the UK arm of South African retailer The Foschini Group, says it “identified a cybersecurity incident on 11 October 2026 affecting certain of its IT systems, specifically our Phase Eight, Hobbs and Whistles brands” [1].
Two other TFG London brands, Inside Story and White Stuff, “are not affected”, the company says [1].
What TFG has confirmed
From the stock-exchange announcement [1]:
- Stores are trading. “TFG London’s stores remain open and trading, although several of its IT systems remain unavailable.”
- Outside help. TFG London has “engaged external cybersecurity specialists to contain the incident”.
- Authorities told. The incident “has been reported to the relevant UK authorities”.
- Rest of the group unaffected. TFG’s businesses in Africa and Australia “run on separate systems and are not affected”.
- Data question open. The investigation includes “establishing whether any personal or other sensitive information has been compromised”. If so, TFG London will notify those affected.
A SENS announcement is a notice on the Johannesburg Stock Exchange’s news service, which listed companies use to tell shareholders about material events.
What customers were told (REPORTED)
In an email to customers, TFG London said: “Importantly, payment processing is carried out by a third-party provider. Based on our investigation so far, we have no reason to believe that payment information is at risk,” according to The Telegraph [2] and the Manchester Evening News [3].
The email also said: “We do not believe it is necessary to change your account login information at this time” [2][3].
REPORTED: Orders placed with Phase Eight, Hobbs or Whistles after Sunday 11 October could be delayed, though customers do not need to resubmit them, PA Media reported [4]. Orders placed before Sunday will be processed and delivered as normal, according to the same report [4].
What has not been disclosed
TFG has not said how the attackers got in, whether ransomware was involved, who was responsible, or how many customers might be affected. TSN is not speculating on any of these.
What it means for shoppers
- Card details: the company says payments go through a third party and it has no reason to think payment information is at risk, based on its investigation so far [2].
- Watch for scams. The company’s email reminded customers that Hobbs “will never ask for passwords or full payment card details by email, text or phone” [3]. Be wary of messages that mention the incident and ask for details.
- Expect updates. TFG says it will tell affected people if personal information turns out to have been compromised [1].
Sources
- The Foschini Group Limited, “Cybersecurity incident at TFG London”, JSE SENS announcement, 13 October 2026. https://www.businessday.co.za/sens/562936/
- The Telegraph, “Hobbs and Phase Eight-owner hit by cyber attack”, 13 October 2026 (paywalled; quotes checked against excerpt). https://www.telegraph.co.uk/business/2026/10/13/hobbs-and-phase-eight-owner-hit-by-cyber-attack/
- Manchester Evening News, “Fashion retailer behind Hobbs, Phase Eight and Whistles hit by ‘cybersecurity incident'”, 13 October 2026. https://www.manchestereveningnews.co.uk/news/greater-manchester-news/customers-of-fashion-house-hobbs-34755783
- PA Media via Express & Star, “Hobbs and Whistles owner struck by cyber attack”, 13 October 2026. https://www.expressandstar.com/uk-news/hobbs-and-whistles-owner-struck-by-cyber-attack-9283394
Related stories
- Ahold Delhaize Takes Some Systems Offline After a Network “Security Issue”; Albert Heijn, Etos and Gall & Gall Online Orders Halted
- Cyberattack on Danfoss Refrigeration Controls Hits Hundreds of French Supermarkets; Intermarché Owner Says 300 Stores Affected
- Cyber breaches this week: credential reuse, retail alerts, campus ransomware and edge-gear risk
