Hobbs and Whistles

Summary

Hobbs and Whistles confirmed that customer personal data was accessed during a cyber attack affecting IT systems across its fashion brands. The company identified the incident, activated its incident response and business continuity plans, and engaged independent cybersecurity specialists to contain the breach while notifying relevant authorities. Potentially exposed information included contact and delivery details, order information, and in some cases limited payment details such as the last four digits of payment cards, though no usable payment card data or login credentials were accessed. Stores remained open despite disruptions to some systems and online services, while other brands and international operations on separate systems were unaffected.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

TFG London, the UK arm of South African retail group The Foschini Group, identified a cybersecurity incident on 11 October 2026 that affected IT systems used by its fashion brands. The company initially disclosed the cyber attack in October, stating that certain IT systems across Phase Eight, Hobbs and Whistles had been affected. Following the discovery, the group activated its incident response and business continuity plans and brought in external cybersecurity specialists to contain the incident. TFG London contacted customers on 28 October after its investigation found that some personal information had been accessed. In an email to customers, TFG London chief executive Justin Hampshire stated that the business had acted immediately to secure its systems, enlisted independent cybersecurity specialists, and notified the relevant authorities. Hampshire added that the investigation was continuing to establish exactly what information had been accessed and emphasized that contacting customers did not necessarily mean their individual information had been compromised.

The data potentially affected included contact and delivery details, order information, and, in some cases, limited payment information such as the last four digits of a payment card. TFG London said the breach did not involve usable payment card details and that its investigation had found no evidence that account login information or passwords had been accessed. Payment processing is handled by a third-party provider, and the company said customers did not need to take immediate action. However, it advised shoppers to remain alert to unexpected emails, phone calls, and text messages, warning that compromised information could be used to make fraudulent communications appear more convincing. The retailer also reminded customers that Phase Eight would never ask for passwords or full payment card details by email, text, or telephone. Its stores remained open, although some systems and online services were disrupted. The group's other UK brands, White Stuff and Inside Story, were unaffected, as were its operations in Africa and Australia, which run on separate systems.

Sources

Sources available to members: 1 source.