Cyber-Attack Puts Hobbs and Whistles Customer Data at Risk

Published: 13 October 2026. The English Chronicle Desk. The English Chronicle Online

The owner of British fashion brands Hobbs, Whistles and Phase Eight is investigating a cyber-attack that may have exposed customers’ personal information, raising fresh concerns about digital security across the UK retail industry. The incident has disrupted online shopping services at the three brands, while the company works with cybersecurity specialists to determine whether sensitive data has been accessed.

TFG London, the UK retail business owned by South African-listed The Foschini Group, identified what it described as a cybersecurity incident on Sunday. The company said the attack affected the websites and information technology systems of its three fashion brands, prompting it to suspend online orders as a precaution while investigations continued.

The company has emphasised that its physical stores remain open and trading. However, some of its IT systems are still unavailable, and certain website functions may remain inaccessible while technical teams investigate the incident and work to contain the threat.

The central concern is whether hackers obtained customer information or other sensitive material. TFG London has not confirmed that personal data was stolen, and the investigation is continuing. The company has said it will notify affected individuals or organisations if the inquiry establishes that their information has been compromised.

The uncertainty leaves customers waiting for clarity about the nature and extent of the incident. Until investigators establish which systems were affected and whether unauthorised access occurred, it remains unclear whether the breach involved personal details, account information or other commercially sensitive data.

TFG London said it had engaged external cybersecurity specialists to help contain the incident and assess its impact. The company has also reported the attack to the relevant UK authorities, indicating that the matter is being handled as a formal security incident rather than a routine technical interruption.

In a statement, the retailer apologised for the disruption and said some online services might remain unavailable during the investigation. It pledged to provide further updates as appropriate, although it has not announced a definitive timetable for restoring all affected digital services.

The company’s other UK brands, Inside Story and White Stuff, have not been affected, according to TFG London. Its operations in Africa and Australia also run on separate systems and are reported to be unaffected. This separation suggests that the incident has so far been confined to the systems supporting the three UK fashion businesses, although the full technical findings have yet to be established.

For customers, the immediate concern is whether information they supplied when shopping online has been exposed. Retail websites commonly process details such as names, delivery addresses, contact information and purchase histories. However, TFG London has not confirmed that any particular category of customer information was accessed in this incident.

The company’s decision to suspend online orders illustrates the operational consequences of a cyber-attack even when physical shops continue to function. Digital sales have become an important part of fashion retail, allowing customers to browse products, place orders and arrange deliveries without visiting stores. Interruptions to these services can affect sales, customer confidence and the ability to fulfil demand.

The attack comes less than a week after online fashion retailer Asos disclosed a separate cybersecurity incident in which hackers accessed information relating to millions of customers. The information reportedly included names, addresses and recent search data, highlighting the amount of personal information that can be held by large online retailers.

The timing has increased scrutiny of the sector’s exposure to digital threats. Although the TFG London and Asos incidents are separate, their close proximity has renewed questions about whether retailers are adequately protecting customer information and maintaining resilience against increasingly sophisticated attacks.

Another major retailer, H&M, said on Monday that it was investigating claims that its systems had been attacked. The company stated that it had found no indication that its data environment had been compromised. Its response illustrates the importance of distinguishing between allegations of an attack, confirmed unauthorised access and a verified data breach.

The wider retail sector has already experienced costly cyber incidents. Marks & Spencer, the Co-op and Harrods were among British retailers affected by damaging cyber events in 2025. Those incidents demonstrated how technology failures can extend beyond websites and customer databases, disrupting stock management, supply chains and everyday shopping operations.

Marks & Spencer experienced significant disruption and had to keep its website offline for several weeks while working to ensure that its systems were secure. The Co-op also faced operational difficulties, while Harrods was among the retailers targeted by a cyber-attack. These cases highlighted how quickly digital incidents can affect businesses whose operations depend on interconnected technology.

For fashion retailers, the potential consequences can be particularly broad. Online stores often rely on a combination of customer databases, payment services, inventory platforms, logistics providers and external technology suppliers. A weakness in one part of that network can create opportunities for attackers to gain access or interrupt services elsewhere.

Marijus Briedis, chief technology officer at digital security firm NordVPN, said the latest incident reinforced the concern that retail businesses remained attractive targets for cybercriminals. He pointed to the value of customer information and the complexity of the systems retailers use to operate their businesses.

Retailers’ reliance on numerous suppliers and technology providers can expand the number of potential entry points for attackers. Stolen login credentials, human error and gaps in security controls can all contribute to vulnerabilities, particularly where organisations must connect different systems to support online sales and customer services.

Cybersecurity specialists commonly advise businesses to limit access to sensitive information, monitor unusual activity, maintain reliable backups and ensure that security controls are regularly reviewed. Employee awareness and the protection of third-party connections are also important, since attackers may seek to exploit weak points outside a company’s core systems.

For affected companies, responding to an incident requires more than restoring website access. Investigators must establish how the attack occurred, identify any compromised systems, determine whether data was accessed or removed, and prevent further unauthorised activity. Depending on the findings, businesses may also need to reset credentials, strengthen security measures and inform customers or regulators.

The response can be complicated when the initial evidence does not establish whether customer data has been exposed. A company may need to restrict access to systems while forensic specialists examine activity logs and other technical records. Although such measures can inconvenience customers, they can also help limit further damage while the investigation proceeds.

Customers who shop with Hobbs, Whistles or Phase Eight should follow official company updates and remain alert to unexpected messages claiming to come from the brands. Cybercriminals sometimes exploit the publicity surrounding a breach by sending convincing emails or text messages that ask recipients to confirm personal details, disclose passwords or follow suspicious links.

Customers should be cautious about requests for account credentials or payment information, particularly if a message creates urgency or directs them to an unfamiliar website. Using unique passwords and enabling additional account security where available can reduce the consequences of compromised login details. However, customers should not assume their data has been stolen solely because the company is investigating an attack.

The investigation’s eventual findings will determine whether further action is necessary. If personal information is confirmed to have been compromised, TFG London has said it will notify affected individuals or organisations. Such communication would be important in helping customers understand what information may have been exposed and what steps they should take to protect themselves.

For the company, the challenge is to restore digital services without compromising the investigation or exposing systems to further risks. A prolonged interruption could affect online sales and customer confidence, while insufficiently secured restoration could leave the business vulnerable to another incident.

The latest attack underscores the growing importance of cybersecurity in an industry that depends heavily on digital transactions and customer trust. With Asos recently reporting a separate incident and other retailers examining possible threats, pressure is likely to increase on fashion businesses to demonstrate that their systems can protect sensitive information and recover quickly when attacks occur.

For now, the extent of the potential exposure at Hobbs, Whistles and Phase Eight remains unknown. TFG London’s investigation will need to establish whether customer data was accessed, how the incident occurred and what safeguards are required before normal online operations can fully resume. Until those questions are answered, the case serves as a reminder that the effects of cybercrime can reach beyond technology systems, affecting shoppers, employees and the confidence on which retail businesses depend.