TFG London Halts Online Orders After Cyber Incident Hits Three Brands
TFG London has paused all online orders for Phase Eight, Hobbs and Whistles after finding a cybersecurity incident affecting the three brands on Sunday.
TFG London owns Phase Eight, Hobbs and Whistles and is the UK arm of South African retailer Foschini Group. Reuters The company said customers' personal data may have been compromised, meaning possibly viewed or taken without permission. An investigation is under way to establish whether personal or sensitive information was accessed. The Guardian
The scope, as described by the company on 13 October, is limited to those three fascias, a retail term for brand names. Its Inside Story and White Stuff brands are not affected. Operations in Africa and Australia run on separate systems and are not affected.
Stores stayed open. Trading continued after the incident, but some IT systems remain unavailable. The online pause was taken as a precaution while containment and investigation continue.
The impact falls on online orders and returns. Whistles told customers that orders placed on or after 11 October may be delayed, while orders placed before 11 October are being processed normally. Returns can only be made in stores at present. Hobbs and Phase Eight separately warned customers of order delays.
On response, TFG London said it brought in external cybersecurity specialists to contain the incident and reported it to the relevant UK authorities. It said it would notify affected individuals or organisations if personal information was found to have been accessed. The company apologised to customers for the disruption. BBC
The broader context here is the trade-off retailers face once an intrusion is found in shopper-facing systems. Suspending online ordering limits further exposure of order and payment data. It gives responders a stable setting to copy affected systems for study and preserve logs, like freezing a scene for evidence. It also shifts shoppers to stores, which explains the emphasis on stores staying open and store-only returns.
What matters for containment comes down to two details. First, using outside specialists and notifying UK authorities follows the normal sequence of contain, investigate, then notify based on evidence rather than suspicion. TFG London has not confirmed data was taken, only that access was possible. Second, separation between systems appears to have limited the spread. If confirmed, the fact that other brands and Africa and Australia operations were unaffected points to separate systems rather than a group-wide failure.
For customers and business partners, the open questions are about evidence. Which data stores were involved, what time window applies, and whether payment data, contact data or login details were involved will determine who must be notified and what fixes are needed. Until the investigation answers that, the guidance around the 11 October date and the store-only returns policy are the practical details to watch.
