Owner of fashion brands Hobbs and Whistles joins autumn pwned collection

Your online fashion orders may be delayed as TFG London systems are offline after a cyberattack.

The owner of fashion brands Hobbs, Phase Eight, and Whistles, TFG London, has suffered a cybersecurity incident discovered on October 11, 2026. Several IT systems remain offline, and customers may face delays with orders placed since October 13. The company confirmed the incident affected all three brands under its UK business, TFG London. While store operations are unaffected, some website functions may be unavailable. TFG stated that a third-party provider handles payment processing and that payment information is not believed to be at risk. The investigation is ongoing to determine if any other personal or sensitive customer information has been compromised. TFG has activated incident response plans, engaged external cybersecurity specialists, and notified relevant UK authorities. This incident follows recent cyberattacks on other fashion retailers, including ASOS and a reported incident at H&M.

This incident highlights a persistent vulnerability in the retail fashion sector, which has seen multiple high-profile cyberattacks in quick succession. The repeated targeting of fashion brands suggests that the sector remains an attractive, and potentially under-defended, vector for cybercriminals seeking customer data. The reliance on third-party payment processors, while a mitigating factor for payment data, underscores the complexity of securing the entire customer data chain. Retailers must increasingly focus on comprehensive third-party risk management and robust incident response to protect sensitive customer information beyond just payment details.

The ongoing nature of the TFG London incident, with systems still offline and the full extent of data compromise under investigation, points to the significant operational and reputational challenges posed by such attacks. The fact that TFG's African and Australian operations, running on separate systems, were unaffected, suggests a potential weakness in the UK-specific IT infrastructure. As cyber threats evolve, retailers must continuously invest in resilient IT architectures and advanced security measures to prevent widespread disruption and safeguard customer trust across all their brands and geographies.