Tuesday, October 13, 2026
Tech

Cyberattack hits Hobbs, Phase Eight and Whistles: what shoppers should know

Rive News Research Desk

Published · 5 min read

Key takeaways

  • TFG London found a cyberattack on Sunday, October 11, hitting Phase Eight, Hobbs, and Whistles.
  • Stores stay open, but some website tools are down and newer orders may face delays.
  • The firm sees no sign that payment data is at risk, but it has not yet ruled out a leak of personal data.
A busy London shopping street
Oxford Street in London. TFG London runs Hobbs, Phase Eight, and Whistles on the UK high streetPhotograph: Edwardx / Wikimedia Commons (CC BY-SA 4.0)Image: Wikimedia Commons

A cyberattack hit three UK fashion brands. Hobbs, Phase Eight, and Whistles all lost some IT systems. Stores stayed open, but parts of their websites went dark.

The parent firm is TFG London. It is the UK arm of The Foschini Group, a retail group based in South Africa. TFG said it found the incident on Sunday, October 11. It shared the news in a public notice on Tuesday, October 13.

What happened

TFG London said the attack hit "certain of its IT systems." The three brands named were Phase Eight, Hobbs, and Whistles. Two other TFG London brands were not hit: Inside Story and White Stuff.

TFG said its Africa and Australia arms run on separate systems and were not affected, according to TechCentral.

The firm moved fast once it found the problem. It switched on its incident response and business continuity plans. It also brought in outside cyber security experts to contain the attack.

TFG said it had reported the incident to the relevant UK authorities, according to TechCentral.

What the attackers did is still unclear. TFG has not said what kind of attack it was. It has not named any group behind it.

The probe is still open, and more facts may follow in later notices.

The timing adds to a rough month for UK retail. A week earlier, fast fashion firm ASOS said an unauthorised party had reached some personal data, including names and contact details. The BBC reported that H&M is also probing claims of a hack linked to a group called ShinyHunters.

H&M said it had found no sign so far that its data was hit. UK retail has seen a run of attacks, including hits on Marks and Spencer, the Co-op Group, and Harrods in 2025, TechCentral reported.

Why it matters

For shoppers, the key question is simple. Is my money safe? TFG said there is "no reason to believe that payment information is at risk.

" The BBC reported that a customer email from TFG said the same thing. That is reassuring, but it is not the full story.

The firm does not yet know if personal data leaked. TechCentral reported that TFG said it does not yet know whether customer or other sensitive data was hit. If the probe finds that such data leaked, TFG London said it will tell the affected people or firms.

That part is still open, so shoppers should stay alert.

This kind of attack works in a simple way. Attackers break into a firm's computers. They may lock systems, steal data, or both.

Shops then lose tools they rely on each day. That can slow orders, returns, and web pages. It can also expose customer records if the attackers copy them.

The scale of the brands makes the news bigger. Hobbs, Phase Eight, and Whistles are well-known UK high street names. Many shoppers have accounts, order histories, and saved addresses with them.

Any leak of that data could feed scam emails or fake calls. That is why the firm's next update matters so much.

The attack also fits a wider pattern. Retailers hold large piles of customer data. Criminals see that data as a target.

A cyberattack on French supermarkets recently showed how hackers can even reach store systems like fridges. The TFG case shows the same risk on the fashion high street.

What happens next

First, expect a fresh update from TFG. The firm said it will share more news as the probe moves on. The key fact to watch is whether personal data leaked.

That answer will shape what shoppers must do next.

Second, know the state of orders. Shoppers who placed orders with Phase Eight, Hobbs, or Whistles before Sunday were told their orders will go ahead as normal, Business Live reported. Orders placed after Sunday may face delays.

TFG said buyers should not resubmit those orders. A duplicate order could charge you twice.

Third, know the state of returns. In-store returns still work as normal, Business Live reported. Postal returns are a work in progress.

TFG said it is working on a fix for postal returns and will keep shoppers posted. If you need to return an item, a store visit is the safe choice for now.

Fourth, guard your accounts. You do not need to panic, but a few simple steps help. Watch for odd emails or texts that claim to come from Hobbs, Phase Eight, or Whistles.

Do not click links in such notes. Go to the brand's site by typing the address yourself. If you reuse one password across many sites, change it on the brand's site and on your email.

Passkeys are a stronger sign-in option where sites offer them.

Another view of Oxford Street shops
Shops on Oxford Street. TFG London said stores stay open while some website tools stay downPhotograph: Edwardx / Wikimedia Commons (CC BY-SA 4.0)Image: Wikimedia Commons

Fifth, watch for the firm's direct notice. If the probe finds that your data leaked, TFG London said it will tell you. That notice may come by email.

Treat any such email with care. Check that it comes from the brand's real domain before you click anything in it.

For now, the shops are open and the card risk looks low. The open question is personal data. Until TFG closes that gap, the smart move is calm care.

Check your orders, use stores for returns, and stay sharp for scam notes that ride on this news.

Taggedcyberattackhobbstfg london

Related stories