What information was at risk
The company identified the attack on October 11, 2026. Information potentially exposed included customers' contact details, delivery details and order records. For some customers, it also included limited payment information, such as a card's last four digits.
TFG London said no usable payment card details were involved. It also said investigators had found no evidence of access to account login information or passwords. Payments are processed by a third-party provider.
In an email to customers, Chief Executive Justin Hampshire said the company moved immediately to secure its systems, brought in independent cybersecurity specialists and alerted the relevant authorities. Investigators were still determining precisely which information had been accessed.
The company also said its investigation indicated that some customer and employee personal data may have been accessed. It had notified both customers and employees directly.
Although TFG London said customers did not need to take immediate action, it urged them to watch for unexpected calls, texts and emails. Criminals could use exposed information to make fraudulent messages more credible. The retailer said Phase Eight would never seek a password or full payment card details over the phone, by email or by text.
Stores stayed open as some systems remained unavailable
Following the attack, TFG London kept its stores open for business despite several IT systems remaining unavailable. The company also said every brand website was fully operational, with online orders and returns still being accepted.
TFG London is the UK subsidiary of South Africa's The Foschini Group, which trades on the Johannesburg Stock Exchange under the share code TFG. Its portfolio also includes homeware brand Inside Story and lifestyle retailer White Stuff. Those two brands use separate infrastructure, and the company said White Stuff customers were not affected.
The parent group disclosed the incident to JSE shareholders through a SENS announcement on October 13, 2026. It said the relevant UK authorities had been notified. TFG Africa and TFG Australia were unaffected because their operations use separate systems.
Separate attacks elsewhere in retail
Other retail cyberattacks reported in October 2026 involved ASOS, around October 6, and H&M Group. French grocers Intermarché and Coopérative U also experienced a separate attack on refrigeration control systems. Retail Gazette reported that there was no confirmed evidence connecting the TFG, ASOS and H&M incidents.
Thousands of ASOS customers received an app notification headed "ASOS hacked". The message read: "Dear ASOS DPO and IT, we have fully compromised the Snowflake instance. Engage with us, or we will leak it," and contained a Telegram link.
ASOS said it was investigating unauthorized activity on third-party services it used for customer communications. It restricted access to the notification platforms and worked with internal and external specialists and the relevant authorities. At the time, the company said its website and app were functioning normally, with no disruption to operations.
ASOS also confirmed that an attacker had obtained an employee's login credentials and that customer information may have been accessed through third-party platforms.
