TFG London, which owns the fashion brands Phase Eight, Hobbs and Whistles, says it is investigating a cyber-security incident that has affected some of its IT systems. In a separate case, BBC News reports that H&M is looking into a claim by a hacking group that it attacked the retailer.
What happened
BBC News reports that TFG London, the UK arm of the retail group The Foschini Group, found the incident on Sunday. In a statement to the BBC, the company said the incident affected some IT systems and was “specifically impacting our Phase Eight, Hobbs, and Whistles brands”. It added: “We are actively investigating and working with external cyber security specialists.”
TFG said its shops are open as normal, but some functions on its websites may not be working. The company apologised for any disruption and said it would update customers “as appropriate”.
According to an email to customers seen by the news agency PA, the group does not believe customers’ payment information was affected. The email said the company was still working out whether any sensitive customer information had been accessed, and that anyone whose personal information was affected would be told directly. It also said: “We do not believe it is necessary to change your account login information at this time.”
On Monday, there were also reports that H&M was investigating a claim by a cyber-criminal group called ShinyHunters that it had hacked the company. The BBC notes that this group has previously been linked to high-profile attacks on the FBI, Rockstar Games and Ticketmaster. In a statement to BBC News, H&M said it was aware of information circulating online about a possible incident and was investigating. It added: “At this time, we have not found any indications that our data environment has been compromised.”
Both cases come a week after customers of the online fashion and beauty retailer Asos learned through a push notification on their phones that the company had been hacked by another group. Cyber-security experts told the BBC that it was unprecedented for hackers to turn an app’s notification system into what was effectively a “ransom note”. It later emerged that the hackers had obtained more detailed personal information than Asos first suggested. The retailer sent customers an update after BBC News told it that cyber criminals had been in contact claiming the breach went beyond the “basic contact details” Asos had first mentioned.
Why it matters if you live in United Kingdom
Phase Eight, Hobbs and Whistles are well known on British high streets and online. If you have an account with any of them, the guidance so far is clear: TFG says shops are trading normally, it does not believe payment details were affected, and it does not think you need to change your login details at this stage. Its websites may not work fully for now, so some online services could be unavailable for a while.
If your personal information turns out to have been affected, TFG says it will contact you directly. You should still be careful about any message that claims to come from these brands. Beverley Griffiths, a senior lecturer in security and resilience at Bucks New University, told PA that customers should stay “vigilant” and be wary of suspicious messages. She described the incident as “a clear sign that major brands are firmly in the crosshairs of cyber attackers”.
The BBC says fashion companies from Adidas to Alexander McQueen have been targeted by cyber-criminals who try to extort money by threatening to publish customer data unless a ransom is paid. If you shop with several fashion retailers, your details may be held by more than one company that is now under pressure. “No organisation is immune, so the real test of resilience is how quickly a business can detect an incident, respond and recover while keeping its customers informed,” Griffiths said.
For H&M customers, the position is different. The company says it has found no sign so far that its data has been compromised, and the claim from ShinyHunters has not been confirmed.
The Asos case is a useful lesson. The first account of what was taken later turned out to understate the breach. Early reassurance from any retailer may change as an investigation goes on, so customers should keep an eye on official updates.
What to watch next
The main question for TFG customers is whether any sensitive information was accessed. The company says its investigation is ongoing and that it will tell affected customers directly. Watch your inbox for messages from Phase Eight, Hobbs or Whistles, and check that any message really comes from the brand before you click a link.
Charlotte Wilson, head of enterprise at the cyber-security firm Check Point, told the BBC that attacks on retailers were “starting to look rather like buses… you wait for one, and suddenly three come along at once”. She said it was too early to know how the TFG incident happened or whether it was linked to other recent hacks. She added that “the retail industry has some serious questions to answer about how exposed its systems have become”.
For H&M, the next step is the result of its investigation into the ShinyHunters claim. Any further updates from Asos about the extent of its breach will also show how well retailers are keeping customers informed after an attack.
Source: BBC News
Sources
- BBC News: Phase Eight and Hobbs owner hit by cyber-attack, as H&M probes separate hack claim, accessed 13 October 2026
The UK, for internationals
One email a week: the week's news for internationals in the UK, new practical guides and what changed in the cities. No spam, unsubscribe any time.
