Key takeaway: A breach anywhere in a retailer’s vendor chain, not just its own systems, can pause online sales and leave customer data exposure an open question for days.
TFG London, the UK arm of South Africa’s The Foschini Group, confirmed the cyberattack on October 13, 2026. The company said it detected the attack two days earlier. The attack disrupted online ordering and returns processing at its Phase Eight, Hobbs and Whistles brands.
The company said it identified the incident on Sunday, October 11. Physical stores remained open, though some IT systems supporting the three brands’ websites and order processing went offline. “On Sunday, 11 October, TFG London identified a cybersecurity incident affecting some of our IT systems, specifically impacting our Phase Eight, Hobbs, and Whistles brands,” a TFG London spokesperson said, adding that the company is “actively investigating and working with external cyber security specialists.”
Customers who ordered before the incident should still receive their items as normal, the company said. TFG London said orders placed after Sunday could face delays, and advised customers not to resubmit them. The company also said customers could still make in-store returns, while it worked on a solution for postal returns.
TFG London said it has no reason to believe payment information is at risk. The company’s investigation into whether customer data was accessed remained open as of this writing [confirm current status immediately before publish]. External cybersecurity specialists are helping contain and investigate the breach.
The incident follows ASOS’s disclosure, about a week earlier, that hackers had accessed some customer personal data. The hackers compromised an employee account and used it to reach third-party platforms. It also follows a wave of 2025 and 2026 cyberattacks on UK retailers, including Marks & Spencer, Co-op and Harrods. Investigators have linked several of those attacks, at least in part, to compromised help desk or third-party vendor access. That is different from a direct breach of the retailer’s own core systems.
Why it matters: Several of these incidents share a similar pattern. Attackers reached a retailer’s customer and order data through a vendor, contractor or third-party platform. They did not breach the retailer directly. That pattern means merchants’ fraud and chargeback exposure increasingly depends on security decisions that vendors, not the merchants themselves, make.
Merchants rely on third-party platforms for order processing, payments or customer communications. They should expect continued scrutiny of those vendor relationships. A breach anywhere in that chain can pause online sales and raise fraud risk. That risk exists even when a retailer’s own payment systems stay secure.
Sources: IT Pro; TFG London statement via ITV News
