Hobbs Cyber Attack Disrupts TFG London Brands

Update, 13 October 2026: TFG London said there was no reason to believe payment information was at risk, while whether personal data was compromised remained under investigation. (Source: The Independent .)

The Hobbs cyber attack has disrupted IT systems supporting three prominent UK fashion brands. TFG London identified the incident on 11 October 2026, affecting Hobbs, Phase Eight and Whistles.

Stores have remained open, but several systems became unavailable, some brand websites were affected and online orders placed from 11 October may be delayed. TFG London has engaged external cyber specialists, activated business continuity measures and notified the relevant UK authorities.

Hobbs cyber attack affects three fashion brands

TFG London is the UK arm of South African retail group The Foschini Group. Its public disclosure said the cyber incident affected systems used to support Hobbs, Phase Eight and Whistles, creating disruption across parts of their digital retail operations.

The operational impact centres on IT availability rather than the closure of physical shops. Although stores continued trading, the loss of access to several systems affected websites and the processing of online orders. Customers who placed orders on or after 11 October were warned that their deliveries could be delayed.

Customer communications reported on 13 October asked shoppers not to submit replacement orders. Reordering could create duplicate purchases once systems and order processing return to normal, while also increasing pressure on teams working through the backlog.

The scope disclosed so far is limited to the three named brands. Inside Story and White Stuff, which are also part of TFG London, were not affected. The wider group’s operations in Africa and Australia were also unaffected because they operate through separate systems.

This separation is an important detail in the Hobbs cyber attack. It indicates that the disruption did not spread across every business within the international group, although TFG London has not published a technical explanation of how its systems are divided or where the compromise began.

Timeline of the TFG London incident

Incident identified on 11 October

TFG London identified the cybersecurity incident on Sunday 11 October 2026. It responded by activating its incident response and business continuity arrangements, bringing in external specialists and reporting the matter to the relevant UK authorities.

During the initial response, several IT systems supporting Hobbs, Phase Eight and Whistles remained unavailable. The company kept stores open, while disruption to websites and e-commerce operations led to warnings delayed online orders.

Public disclosure on 13 October

The Hobbs cyber attack was first made public through a Johannesburg Stock Exchange SENS notice issued by The Foschini Group at 07:05 SAST on 13 October 2026, equivalent to 06:05 BST. The notice set out the affected brands, the continuing systems disruption and the unaffected parts of the business.

UK media reporting followed that morning. The first located UK report appeared at 07:42 BST, while further reporting at 08:14 BST included details from customer emails potential order delays and third-party payment processing.

As of the morning of 13 October, the investigation remained active. TFG London had not announced when all affected systems or online services would be fully restored.

How the Hobbs cyber attack disrupted operations

This is a compromise of corporate systems, not a publicly disclosed vulnerability in a named software product. Consequently, there are no affected software versions, security patches or proof-of-concept exploits for organisations to assess.

The known impact is disruption to systems that support retail and e-commerce activity. When those systems are unavailable, brands may have difficulty receiving, processing, tracking or updating orders, even if customer-facing websites remain partly accessible and shops can continue trading.

TFG London has not disclosed the initial access route or explained whether attackers exploited a technical weakness, compromised credentials or used another method. It has also not published indicators of compromise such as malicious domains, IP addresses, file hashes or malware names.

No threat actor has been publicly attributed to the Hobbs cyber attack. There has also been no confirmation of ransomware deployment, an extortion demand or a claim posted to a criminal data leak site. Describing the event as ransomware or naming a suspected group would therefore go beyond the evidence currently available.

Payment information and other data

TFG London said it had no reason to believe payment information was at risk because card payments are processed through a third-party provider. This reduces the likelihood that payment card details were present within the directly affected systems, but it does not establish that no other information was accessed.

The investigation into other potentially sensitive data is continuing. The company has said that it will notify affected individuals or organisations if evidence shows that relevant information has been compromised.

Current exploitation and recovery status

The confirmed in-the-wild activity is the operational disruption experienced by the three brands from 11 October. The Hobbs cyber attack is therefore an active corporate incident with observed business consequences, rather than an unexploited security weakness disclosed through an advisory.

At the time of reporting, external cyber specialists were supporting the investigation and recovery process. Business continuity plans were active, authorities had been notified and physical stores remained open. Some website and order-processing disruption was still being reported.

The currently confirmed position can be summarised as follows:

Hobbs, Phase Eight and Whistles systems were affected.

Several IT systems were unavailable and some websites experienced disruption.

Online orders placed from 11 October may be delayed.

Customers have been advised not to place duplicate orders.

Inside Story and White Stuff were not affected.

TFG Africa and TFG Australia were not affected.

Payment data is not currently believed to be at risk.

No attacker, ransomware family or data theft has been confirmed.

Why the Hobbs cyber attack matters

The incident demonstrates how a cyber compromise can interrupt retail fulfilment without forcing shops to close. Website availability, stock visibility, warehouse coordination, customer service and order processing depend on connected systems, so disruption in one part of that environment can produce delays across the purchasing journey.

Suppliers, logistics providers and other businesses working with the affected brands may also encounter delayed instructions, order updates, returns or reconciliations. However, there is no evidence that systems belonging to partners have been compromised.

What organisations and customers should do

Businesses that supply or support Hobbs, Phase Eight or Whistles should monitor official communications, verify unusual requests through established contacts and prepare for possible fulfilment or returns delays. They should not treat unsolicited messages changed payment details, urgent account access or replacement invoices as genuine without independent verification.

Customers awaiting orders should follow the instruction not to reorder and should use official brand websites or established customer service channels for updates. The publicity around the Hobbs cyber attack may also be used in phishing messages that claim a delivery has failed or that a refund requires fresh card details.

Further conclusions data exposure, attribution or the cause of the compromise should wait for confirmed findings. For now, the established impact is a contained but significant disruption affecting three TFG London brands while investigation and recovery work continues.

Originally reported by The Telegraph .

Jonny is a Founding Partner at CyPro and executive group level CISO who has worked closely with the British intelligence agencies NCSC and GCHQ.

An ex-professional rugby player and originating from KPMG and Deloitte, Jonny has a wealth of experience across numerous sectors including technology, critical national infrastructure, financial services, oil & gas, insurance, betting, pharmaceuticals and utilities.

Jonny is a leading cyber security expert in the UK, having featured on national media for his professional commentary such as BBC News, iPlayer, Telegraph and Times Radio.

Ahold Delhaize Incident Disrupts Online Orders

Supermarket Cyberattack Hits French Food Stocks

CyberXero Attacks Target WordPress at Scale

Microsoft X Hack Promotes Clippy Cryptocurrency

OpenAI Agents Hack US Government Websites

OpenAI Agent Hacking Hits Dozens of Organisations

Kiteworks Cyber Attack: Servers Shut Down

OpenAI Medicare Hack Claim Raises AI Agent Risks

Co-op Cyber Attack Followed by GBP 200m Plan

British Library Cyber Attack Recovery Continues

Related CyPro Services

Managed Detection and Response (MDR) Managed Detection and Response (MDR) is an end-to-end managed service designed to help organisations detect, analyse and respond to cyber threats quickly and effectively. It... View Service

Managed Detection and Response (MDR)