The owner of Hobbs, Whistles and Phase Eight has been hit by a cyberattack, raising fresh concerns over the vulnerability of Britain’s fashion retailers as a series of incidents puts the industry on alert.
TFG London said it identified the incident on Sunday, October 11, and is investigating with help from external cybersecurity specialists. The attack has affected some of the group’s IT systems, although its stores remain open.
Some website functions may be unavailable while the investigation continues, the company said.
TFG added that there was currently no reason to believe customers’ payment information was at risk, while cautioning that the full extent of the incident had yet to be established.
The breach comes amid a succession of cyber security concerns across the fashion industry. ASOS disclosed last week that an unauthorised party had accessed some personal data, including customers’ names and contact details.
H&M is also investigating claims that cybercriminals targeted it.
The incidents underscore the operational and reputational risks facing retailers whose businesses depend on interconnected digital systems, from online shopping and customer databases to payments and store operations.
For TFG London, the immediate priority will be determining how the attackers gained access, which systems were affected and whether any sensitive information was compromised.
The company’s assurance on payment data may reassure customers, but the investigation remains ongoing. Until its findings are clearer, the possibility of further disruption or additional disclosures cannot be ruled out.
The latest attack also highlights the challenge facing retailers as they seek to maintain uninterrupted trading while containing potential security breaches. Even when physical stores remain open, disruptions to digital services can affect sales, customer confidence and the ability to manage day-to-day operations.
With ASOS reporting unauthorised access to customer information and fresh claims surrounding H&M, the incidents are likely to intensify scrutiny of how fashion groups protect their systems — and how quickly they can respond when those defences are breached.
Susannah Streeter, Chief Investment Strategist, Wealth Club said: ‘Corporate defences are looking dangerously thin amid an onslaught of cyber-attacks against businesses.
“This spate of infiltrations into retailers’ systems should serve as a brutal alarm call for organisations grappling with increasingly sophisticated digital threats. Big names are littering the landscape, with Marks & Spencer badly affected last year, ASOS still reeling from its breach and now household names Hobbs, Whistles and Phase Eight brought into the cyber-attack wave with the attack on TFG London’s IT systems.
It comes hot on the heels of an audacious attack on supermarket refrigeration systems in France, which saw hackers remotely manipulate cooling controls, sending temperatures soaring and leaving hundreds of stores facing spoiled food, fires and potentially millions of euros in losses.
The scale of the threat is staggering, with Gartner forecasting that global spending on information security will reach $248.9 billion this year, while Cybersecurity Ventures has estimated that cybercrime costs have expanded to $10.8 trillion annually.
That gulf underlines the enormous financial damage cyber-attacks can inflict and raises questions about vulnerabilities in systems. The amount being spent on protection is surging, with forecasts that there will be a much bigger shift away from reactive detection and response strategies towards pre-emptive solutions, reliant on advanced AI tools. It demonstrates the considerable opportunities ahead for firms at the forefront of cyber defence. It is clear that pressure is mounting on businesses to strengthen their defences as attacks become increasingly sophisticated.
Muhammad Yahya Patel, vCISO and cybersecurity advisor for EMEA at Huntress, told LondonLovesTech: “Another week, another UK retailer dealing with a cyber incident. What’s confirmed is instructive enough without speculation. Several IT systems became unavailable. Websites were affected.
“Online orders placed from 11 October may be delayed. The fact that Inside Story and White Stuff within the same group were unaffected, and that TFG’s wider Africa and Australia operations were untouched, suggests some degree of system separation was in place.
“That separation, which limited the blast radius, is worth noting as a positive. The retail sector’s security problem in 2026 isn’t a lack of awareness. It’s the gap between what organisations know they should do and what they’ve actually done about it. That gap is exactly what attackers are measuring when they choose their next target.”
Leave a Comment