TFG London

Summary

TFG London confirmed a cyber attack that affected some of its IT systems, specifically impacting the Phase Eight, Hobbs and Whistles brands. Stores remain open but certain website functions, including online orders and returns, may be unavailable while the incident is investigated. The company has activated its business continuity plan, reported the breach to authorities and is contacting customers whose personal data might have been accessed, noting that payment processing is handled by a third‑party provider and there is no indication that payment information is at risk. The company’s African and Australian operations, as well as its Inside Story and White Stuff brands, are reported to be unaffected, and the exact method of attacker entry remains unknown.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On Sunday 11 October, TFG London identified a cybersecurity incident affecting some IT systems, specifically impacting Phase Eight, Hobbs, and Whistles brands. They confirmed the attack, stated they are investigating with external cyber security specialists. Stores remained open, but some website capabilities may be unavailable. Online orders and returns believed to be affected. They activated business continuity plan, reported incident to relevant authorities, and began contacting customers whose personal data might have been accessed, advising no need to change passwords. Payment processing is handled by a third-party provider, and based on investigation so far, payment information is not believed to be at risk. They continue to work to determine if any sensitive customer information was impacted.

TFG London is the UK subsidiary of The Foschini Group, which also owns brands Inside Story and White Stuff; its African and Australian operations and those brands appear unaffected. The incident follows a pattern of similar attacks on other UK retailers such as M&S, Co-op, Harrods, and ASOS, where unauthorized parties gained access to personal data via impersonation of trusted contacts to obtain login credentials. No cybercrime group has claimed responsibility for the TFG London attack. The exact method of initial access is not known, but investigators consider a third‑party supplier such as a managed service provider or data hosting provider as a possible vector, similar to the ASOS incident.

The disruption has led to limited website functionality for the affected brands while stores continue to operate normally. The company has apologized for any inconvenience and committed to providing further updates as the investigation proceeds. They have emphasized that, at this stage, there is no evidence that payment card data has been compromised due to the third‑party payment processor. The firm continues to monitor the situation and work with specialists to contain the incident and assess any potential data exposure.

Sources

Sources available to members: 1 source.