Cyber incident hits IT systems behind Phase Eight, Hobbs and Whistles
TFG London, the fashion arm of The Foschini Group, has called in outside specialists and is still establishing whether personal data was compromised, while the group’s African and Australian operations are unaffected
- Parent company: The Foschini Group, JSE share code TFG
- TFG London stores at 31 March 2026: 649
- Not affected: Inside Story, White Stuff, TFG Africa and TFG Australia
- Next update: a further SENS announcement if there are material developments
Customers of Phase Eight, Hobbs and Whistles would be the most directly exposed if data was taken, though the group has not said what data the affected systems hold or confirmed that any was accessed. Notification would cover businesses as well as individuals: TFG London has said it will notify affected individuals or organizations if the investigation finds their information was compromised. The company has not named which IT systems are offline or given a timetable for restoring them.
“TFG London’s stores remain open and trading, although several of its IT systems remain unavailable.”The Foschini Group, SENS announcement
The Foschini Group said on 13 October that TFG London, its fashion division, identified a cybersecurity incident on 11 October affecting certain IT systems at its Phase Eight, Hobbs and Whistles brands. The South African retailer disclosed the incident to shareholders in a stock exchange announcement.
The group said it immediately activated its incident response and business continuity plans. TFG London has engaged external cybersecurity specialists to contain the incident, which has been reported to the relevant authorities.
In its results for the year to 31 March 2026, published in June, the group said TFG London’s sales excluding White Stuff were flat in sterling. It attributed weaker performance in the older brands partly to disruption from “a significant cyber incident affecting a key online concession partner”, which it did not name.
BleepingComputer, which reported the incident on 13 October, said it could not find any threat actor publicly claiming the breach. The Foschini Group has not said how the incident began or what kind of incident it was.
Sources
- The Foschini Group, “Cybersecurity incident at TFG London”, SENS announcement, 13 October 2026. https://www4.sharenet.co.za/v3/sens_display.php?scode=&seq=6&tdate=20261013070500
- The Foschini Group, “Condensed consolidated financial statements for year ended 31 March 2026, ordinary and preference share dividends”, SENS announcement, 5 June 2026. https://www9.sharenet.co.za/v3/sens_display.php?scode=TFG&seq=14&tdate=20260605090000
- BleepingComputer, “TFG London cyberattack disrupts systems at Hobbs and Whistles retailers”, 13 October 2026. https://www.bleepingcomputer.com/news/security/tfg-london-cyberattack-disrupts-systems-at-hobbs-and-whistles-retailers/
